What you'll do
You'll own workforce identity at Alloy, from how access is granted and automated to how it is reviewed and removed. You'll be the primary expert for Okta, SaaS access, and identity automation while sharing coverage for broader IT and Security work.
IAM and Okta Administration: Serve as the primary technical SME for workforce identity and access management, including Okta groups, policies, application assignments, admin roles, MFA, and authentication controls.
SaaS Access and Integrations: Manage SaaS access and application onboarding. Implement and maintain SSO integrations using SAML/OIDC, SCIM provisioning and deprovisioning, and Google Workspace access.
Identity Lifecycle and Automation: Maintain and improve employee and contractor joiner/mover/leaver workflows from our HRIS through our IdP and downstream SaaS. Use Okta Workflows and other automation to cut manual access processes.
Access Operations: Troubleshoot authentication and provisioning issues, administer temporary access and exceptions, and make access requests more reliable and efficient.
RBAC Management: Refine, manage, and evolve Alloy's approach to role and attribute based access control.
Privileged Access Management: Mature PAM/TPAM for administrator and production resource access, including just-in-time and temporary access and break-glass procedures.
Non-Human Identity Management: Improve ownership and lifecycle controls for service accounts, system users, API credentials and tokens, OAuth applications, bots, and integrations.
AI Identity and Access: Shape identity and delegated-access controls for AI platforms, AI agents, and MCP integrations, including the scope of access available to tools and agents.
Access Governance and Compliance: Strengthen least privilege and RBAC/ABAC, run access and privileged-access reviews, remediate stale or orphaned accounts, enforce contractor access expiration, and provide IAM evidence for ISO 27001 and SOC 2.
Shared IT/Security Engineering: Take on endpoint security, EDR, DLP, application control, email security, SaaS/security tools, and other IT/Security projects within a shared-SME and backup-coverage model.
Incident Response and Collaboration: Investigate incidents involving identity, users, endpoints, email, and SaaS. Coordinate with teammates and business partners, and keep processes and documentation clear.
On-call Rotation: Join the IT and Security on-call rotation, responding to critical alerts and urgent after-hours support requests.
What we're looking for
Must-haves
Hands-on experience in IT or security engineering, with significant responsibility for Okta or a comparable workforce identity provider
Experience administering IdP groups, access and authentication policies, SaaS application assignments, MFA, and administrative roles
Experience implementing and troubleshooting SAML/OIDC SSO, SCIM provisioning, and OAuth-based integrations
Experience running employee and contractor identity lifecycles across HR systems, an IdP, Google Workspace, and downstream SaaS applications
Ability to automate access workflows using Okta Workflows, APIs, scripts, or comparable tools
Understanding of least privilege, RBAC/ABAC, access reviews, and account lifecycle controls
Working familiarity with endpoint security, EDR, DLP, email security, and SaaS security tooling, and willingness to work beyond IAM
Strong troubleshooting, documentation, and communication skills in a shared-responsibility IT/Security team
Nice-to-haves
Experience with temporary privileged access management platforms
Experience governing non-human identities, service accounts, API credentials, and OAuth applications
Familiarity with identity and delegated access for AI tools, agents, and MCP integrations
Experience with ISO 27001 or SOC 2 controls in a fintech, SaaS, or other regulated environment
Alloy is committed to fair and equitable compensation practices. Below is the anticipated starting base compensation range for this role; however, pay may vary depending on job-related knowledge, in-demand skills, relevant experience, and/or geography. In addition to a competitive base salary, this position is also eligible for equity awards in the form of stock options (ISOs) as well as a competitive total benefits package. Your recruiter will be happy to walk you through the details and what compensation could look like for you specifically!
This position has a base salary range of $162,000 – $190,000.
Benefits and Perks
We invest in your health, your financial future, and your growth. Here's what you can expect:
Medical, dental, and vision coverage from the first of the month after you join, including $0 employee-only premium options, plus FSA options and an Alloy-funded HSA with our high-deductible plan
Healia: if your spouse or partner has health insurance through their employer, Alloy may cover up to 100% of your family's costs on their plan
Alloy-paid One Medical membership, Spring Health therapy and coaching, Superpower advanced lab testing, and ClassPass credits
Stock options for every full-time employee
401(k) with a 100% match up to 4% of pay, vested immediately, plus a mega backdoor Roth option
Free, unlimited 1:1 financial planning through Addition Wealth
Unlimited PTO plus company holidays
16 weeks of fully paid parental leave for eligible birthing, non-birthing, adoptive, and foster parents
Annual learning and development stipend, plus a home office stipend to set up your workspace
Hybrid work environment: most team members work from our HQ in Union Square, Manhattan, Tuesday through Thursday, with in-office expectations that vary by role. Catered lunches from a variety of local restaurants and frequent employee-organized cultural events bring energy to the office. On Mondays and Fridays, many employees work remotely, while some take advantage of the quieter office.
How to Apply
Apply right here! You've found the application!
Alloy is proud to be an equal-opportunity workplace and employer. We're committed to equal opportunity regardless of race, color, ancestry, religion, gender, gender identity, parental or pregnancy status, national origin, sexual orientation, age, citizenship, marital status, disability, or veteran status. We are committed to an inclusive interview experience and provide reasonable accommodations to applicants with visible and invisible disabilities. We encourage applicants to share needed accommodations with their recruiter.
All Alloy jobs are listed on our careers page. Any communication during the recruitment process, including interview requests or job offers, will come directly from a recruiting team member with an alloy.com email address. We do not use outside applications or automated text messaging in our recruiting process. We will not ask for any sensitive financial or identification information during the recruiting process. If you're ever unsure, please contact us directly via our website before sharing personal information.
