<p>Scopely is looking for a <strong>Senior IAM Security Enginee</strong>r to join our Information Security team on a&nbsp; remote basis or hybrid basis if located in Barcelona.&nbsp; This role will focus on building, scaling, and securing Scopely’s identity and access management ecosystem across our cloud, SaaS, AI, and remote access environments, with a strong emphasis on Terraform-based IAM automation, access workflow engineering, least-privilege design, identity risk reduction, and AI-assisted operational workflows.</p> <p>This is a highly technical, hands-on role for someone who can operate across AWS, GCP, Okta, AWS IAM Identity Center, Zero Trust access models, identity governance workflows, and modern AI-enabled engineering environments, while building scalable identity systems through Infrastructure as Code, workflow orchestration, and automation-first security engineering.</p> <p><strong>What You Will Do</strong></p> <p><strong>Build and Evolve Modern IAM Architecture</strong></p> <ul> <li>Design and evolve Scopely’s IAM architecture to support a high-scale, cloud-first environment across AWS, GCP, SaaS applications, AI tooling, and remote access platforms.</li> </ul> <p><strong>Lead initiatives around:</strong></p> <ul> <li>Federated identity architecture using SAML, OIDC, OAuth, and SCIM</li> <li>Workforce identity and access patterns across internal platforms</li> <li>Least-privilege role design and access segmentation</li> <li>RBAC and ABAC models for cloud and SaaS environments</li> <li>Centralized access models using Okta, AWS IAM Identity Center, Google Cloud IAM, and cloud-native IAM services</li> <li>Secure cross-account and cross-project access patterns</li> <li>Service account, workload identity, and non-human identity governance</li> <li>Zero Trust identity and access control design</li> </ul> <p><strong>Partner with engineering, infrastructure, and security teams to:</strong></p> <ul> <li>Standardize secure identity and access patterns</li> <li>Reduce identity sprawl and excessive permissions</li> <li>Improve access visibility and auditability</li> <li>Build scalable identity controls for a fast-moving engineering environment</li> </ul> <p><strong>Own Terraform-Based IAM and Access Automation</strong></p> <ul> <li>Own and improve Terraform-based IAM and access automation across Scopely’s cloud and identity environment.</li> </ul> <p><strong>Design, build, and maintain:</strong></p> <ul> <li>Reusable Terraform modules for IAM roles, policies, permission sets, group mappings, and access patterns</li> <li>Terraform workflows for Okta app assignments, group-based access, and IAM Identity Center automation</li> <li>Standardized access modules that can be reused safely across teams and environments</li> <li>Policy-as-code patterns for least privilege and permission boundary enforcement</li> <li>Terraform-driven onboarding and offboarding flows for identity-related systems</li> <li>Automation for service account and workload identity provisioning</li> <li>Access reporting and audit visibility pipelines connected to code-based IAM workflows</li> </ul> <p><strong>Drive improvements in:</strong></p> <ul> <li>Standardization of IAM modules, variables, role definitions, and policy structures</li> <li>Repeatability and consistency of access changes</li> <li>Reduction of manual IAM operations</li> <li>Auditability and change traceability</li> <li>Safe rollout of identity changes through code review and pull request workflows</li> </ul> <p><strong>Ensure mature Terraform engineering practices around:</strong></p> <ul> <li>State management</li> <li>Drift detection and remediation</li> <li>Rollback planning</li> <li>Blast-radius awareness for IAM changes</li> <li>Safe promotion of access changes into production</li> </ul> <p><strong>Automate Identity and Access Workflows</strong></p> <ul> <li>Build scalable automation for identity lifecycle management, access requests, entitlement changes, access reviews, and day-to-day IAM operations.</li> </ul> <p><strong>Design and implement:</strong></p> <ul> <li>Provisioning and deprovisioning automation</li> <li>Access request and approval workflows</li> <li>Group-based access assignment and role mapping</li> <li>Okta app integration and assignment automation</li> <li>IAM Identity Center permission set automation</li> <li>Self-service identity workflows for internal teams</li> <li>Identity reporting and access visibility pipelines</li> <li>Operational tooling that reduces repetitive IAM work</li> </ul> <p><strong>Work with:</strong></p> <ul> <li>Terraform and Infrastructure as Code workflows</li> <li>Python, Bash, PowerShell, and APIs</li> <li>CI/CD systems and Git-based change management</li> <li>Okta Workflows and similar orchestration tooling</li> <li>ServiceNow, ticketing, and operational workflow integrations</li> <li>AI tools such as Claude Code, Codex, and similar engineering assistants</li> <li>MCP-enabled integrations, agentic workflows, and internal automation platforms</li> </ul> <p><strong>Drive improvements in:</strong></p> <ul> <li>Repeatability</li> <li>Auditability</li> <li>Operational safety</li> <li>Reduction of manual IAM work</li> <li>Secure-by-default access onboarding</li> </ul> <p><strong>Strengthen Identity Security and Risk Reduction</strong></p> <ul> <li>Lead initiatives to reduce identity-related risk across human and non-human identities.</li> </ul> <p><strong>Design and implement controls for:</strong></p> <ul> <li>Excessive permissions and privilege escalation reduction</li> <li>Service account and workload identity hardening</li> <li>Long-lived credential reduction</li> <li>Cross-account trust policy review and hardening</li> <li>Permission boundary enforcement</li> <li>Role lifecycle management</li> <li>Just-in-time and time-bound privileged access</li> <li>Break-glass access workflows</li> <li>Identity anomaly detection and misuse investigation</li> </ul> <p><strong>Use native and third-party tooling to identify and remediate risk, including:</strong></p> <ul> <li>AWS IAM Access Analyzer</li> <li>CloudTrail</li> <li>GuardDuty</li> <li>GCP-native IAM and audit services</li> <li>Okta System Log and access reporting</li> <li>CIEM, CSPM, and related cloud security platforms</li> </ul> <p><strong>Improve Zero Trust and Privileged Access Security</strong></p> <ul> <li>Partner with IAM, platform, and security teams to strengthen Zero Trust and privileged access controls across Scopely’s environment.</li> </ul> <p><strong>Support and enhance:</strong></p> <ul> <li>Twingate connectors, resources, and access policy design</li> <li>Identity-aware remote access controls</li> <li>Zero Trust segmentation for internal applications and privileged systems</li> <li>Privileged access workflows</li> <li>PAM platform integrations such as Britive</li> <li>Adaptive access controls</li> <li>MFA and passwordless adoption</li> <li>Federated access into AWS, GCP, SaaS platforms, and internal tools</li> <li>Secure vendor and contractor access patterns</li> </ul> <p><strong>Drive improvements in:</strong></p> <ul> <li>Human identity security</li> <li>Non-human identity security</li> <li>Access visibility</li> <li>Privileged session control</li> <li>Access policy consistency across environments</li> </ul> <p><strong>Support Identity Investigations, Monitoring, and Audit Readiness</strong></p> <ul> <li>Partner with Security Operations, Compliance, and Infrastructure teams to improve identity monitoring, investigation, and audit readiness.</li> </ul> <p><strong>Build and enhance:</strong></p> <ul> <li>IAM troubleshooting runbooks</li> <li>Identity-related detection and triage workflows</li> <li>Access review processes</li> <li>Permission reporting and evidence collection</li> <li>IAM logging and monitoring design</li> <li>Operational metrics for identity security maturity</li> </ul> <p><strong>Support investigations involving:</strong></p> <ul> <li>Suspicious access activity</li> <li>Identity and permission abuse</li> <li>Misconfigured app integrations</li> <li>Broken federation and provisioning flows</li> <li>Risky SaaS integrations</li> <li>Service account misuse</li> <li>Cross-account access issues</li> </ul> <p><strong>Collaborate with compliance and audit stakeholders to ensure:</strong></p> <ul> <li>SOC 2 and ISO 27001 alignment</li> <li>Access review evidence readiness</li> <li>Documentation of IAM controls and workflows</li> <li>Clear traceability for privileged access and entitlement changes</li> </ul> <p>&nbsp;</p> <p><strong>Build AI-Assisted Identity Security Workflows</strong></p> <ul> <li>Design and improve AI-assisted and automation-first workflows that help Scopely scale identity security safely.</li> </ul> <p><strong>Lead initiatives around:</strong></p> <ul> <li>AI-assisted access review analysis</li> <li>AI-assisted troubleshooting and documentation support</li> <li>Intelligent triage for identity-related findings</li> <li>Security chatops integrations</li> <li>Identity workflow automation using agents and orchestration systems</li> <li>Internal copilots for IAM operations and knowledge support</li> <li>AI-assisted recommendations for access hygiene and remediation</li> <li>MCP-enabled identity tooling and integrations</li> </ul> <p><strong>Work with:</strong></p> <ul> <li>Claude Code, Codex, and similar AI-assisted engineering tools</li> <li>MCP-based workflows and agentic automation patterns</li> <li>Internal automation platforms and workflow engines</li> <li>APIs, event-driven automation, and identity telemetry pipelines</li> </ul> <p><strong>Ensure safe adoption of AI by applying:</strong></p> <ul> <li>Human-in-the-loop approval controls</li> <li>Least-privilege access to tools and data</li> <li>Logging and auditability for AI-assisted workflows</li> <li>Prompt and data handling safeguards</li> <li>Clear separation between recommendations and privileged actions</li> </ul> <p><strong>Act as a Technical Leader</strong></p> <ul> <li>Partner with engineering, platform, IT, and studio teams to align IAM strategy with Scopely’s operational and business goals.</li> </ul> <p><strong>Provide expert guidance on:</strong></p> <ul> <li>Modern IAM architecture</li> <li>Federated identity design</li> <li>Least-privilege engineering</li> <li>Zero Trust access models</li> <li>Non-human identity risk</li> <li>IAM automation strategy</li> <li>Terraform design patterns for identity and access management</li> <li>Access governance in fast-growing environments</li> <li>Secure access design for engineering teams</li> <li>Safe use of AI in identity and access workflows</li> </ul> <p><strong>Influence teams to:</strong></p> <ul> <li>Adopt secure identity patterns</li> <li>Automate IAM safely</li> <li>Reduce reliance on manual access processes</li> <li>Improve cloud and SaaS access consistency</li> <li>Build scalable and maintainable identity controls</li> </ul> <p><strong>Raise the bar for:</strong></p> <ul> <li>Identity-aware security</li> <li>Automation-first IAM operations</li> <li>Practical access governance</li> <li>Engineering-driven IAM design</li> <li>AI-assisted identity operations</li> </ul> <p><strong>What We’re Looking For</strong></p> <p><strong>Core Experience</strong></p> <ul> <li>8–12+ years in IAM security engineering, cloud security, identity architecture, or related security engineering roles</li> <li>Strong experience operating in cloud-first, high-scale environments</li> <li>Experience partnering directly with engineering, infrastructure, and security teams</li> <li>Experience designing and operating IAM solutions for global organizations with complex access needs</li> <li>Strong track record in identity modernization, least privilege, and access automation</li> <li>Proven experience building automation and reusable engineering patterns, not just handling manual IAM operations</li> </ul> <p><strong>Technical Skills</strong></p> <p><strong>Cloud and Identity</strong></p> <p><strong>Strong hands-on experience with:</strong></p> <ul> <li>AWS IAM, AWS Organizations, IAM Identity Center, SCPs, IAM roles and policies, CloudTrail, GuardDuty, IAM Access Analyzer, SSM</li> <li>GCP IAM, service accounts, workload identity patterns, organization/folder/project models, and audit services</li> <li>Okta administration including groups, rules, app integrations, assignments, lifecycle management, and troubleshooting</li> <li>SAML, OIDC, OAuth, SCIM, and federated identity design</li> <li>Cross-account and cross-project access controls</li> <li>Service account and workload identity governance</li> <li>Twingate administration or comparable ZTNA and remote access platforms, including connectors, resources, access policies, and policy troubleshooting</li> </ul> <p><strong>Infrastructure as Code and Automation</strong></p> <p><strong>Strong hands-on experience with:</strong></p> <ul> <li>Terraform-based IAM and access automation in production</li> <li>Designing reusable Terraform modules for IAM roles, policies, permission sets, group mappings, and access patterns</li> <li>Terraform state management, drift detection, rollback planning, and safe deployment of IAM changes</li> <li>Git-based workflows, pull requests, and code review for infrastructure and identity changes</li> <li>Python, Bash, PowerShell, or similar scripting languages</li> <li>API integrations and workflow automation</li> <li>Provisioning and deprovisioning automation</li> <li>Access reporting and policy standardization</li> <li>CI/CD integration for identity-related workflows</li> </ul> <p><strong>Strong understanding of:</strong></p> <ul> <li>Policy-as-code and automation-first IAM</li> <li>How to convert manual IAM processes into reusable code-driven workflows</li> <li>How to build transferable, scalable access patterns across teams and environments</li> <li>Safe production change practices for identity and access automation</li> </ul> <p><strong>AI and Emerging Technologies</strong></p> <p><strong>Experience or strong interest in:</strong></p> <ul> <li>Claude Code, Codex, and similar AI-assisted engineering tools</li> <li>MCP integrations and agent-based automation workflows</li> <li>AI-assisted detection, triage, remediation support, and documentation</li> <li>Prompt security, model safety, and human-in-the-loop operational controls</li> <li>Evaluating and safely operationalizing AI tooling in security environments</li> </ul> <p><strong>Security Expertise</strong></p> <p><strong>Strong understanding of</strong></p> <ul> <li>Least privilege and role engineering</li> <li>RBAC and ABAC design</li> <li>Identity threat modeling</li> <li>Privileged access and JIT access models</li> <li>Identity lifecycle management</li> <li>Non-human identity risk reduction</li> <li>Identity logging and monitoring</li> <li>Access reviews and audit readiness</li> <li>Security controls for SaaS and cloud identity systems</li> </ul> <p><strong>Aptitudes</strong></p> <ul> <li>Builder mindset - creates scalable IAM systems, not one-off fixes</li> <li>Automation-first mentality - reduces manual effort through safe automation</li> <li>Systems thinker - connects IAM, cloud, SaaS, developer workflows, and operational risk</li> <li>AI-forward mindset - embraces intelligent automation while applying practical security guardrails</li> <li>Pragmatic and engineering-oriented - balances security with usability and speed</li> <li>High ownership - operates effectively in complex, fast-moving environments</li> <li>Strong communicator - able to explain IAM risks and solutions to engineers, IT, and leadership</li> </ul> <p><strong>Bonus Points</strong></p> <ul> <li>Experience with Britive, CyberArk, SailPoint, or similar PAM/PIM platforms</li> <li>Experience with Okta Workflows, CIEM platforms, or identity governance tooling</li> <li>Experience with Wiz, GuardDuty, Astrix, or similar tools for identity-related investigations</li> <li>Experience in gaming, SaaS, or multi-studio environments</li> <li>Experience with passwordless authentication, WebAuthn, or FIDO2</li> <li>Experience building AI-assisted workflows for IAM operations, documentation, access