← All roles

MTS Lead, Identity and Access Management

Reflection· Security
Apply on company site
New York, NY, San Francisco, CAFull-timePosted 3mo ago

About the role

Head of Identity and Access Management responsible for architecting, building, and operating Reflection’s identity infrastructure with a zero-trust, phishing-resistant, cloud-native approach across corporate, production, and research environments.

Responsibilities

  • Design and implement a resilient, cloud-native identity architecture leveraging modern IdPs (Okta, OIDC/OAuth 2.0 federations) unified with edge-enforced zero-trust access networks (Cloudflare Access, Tailscale / WireGuard topologies).
  • Architect and evolve the organization’s identity boundary with cryptographically-grounded alternatives at every layer.
  • Own the full identity lifecycle architecture across corporate, production, and research environments, ensuring consistency, auditability, and resilience across all access surfaces.
  • Mandate and enforce hardware-backed authentication (YubiKeys/WebAuthn) globally across all corporate, production, and research endpoints.
  • Eliminate SMS, TOTP, and legacy MFA bypass vectors and drive phishing-resistant authentication as the only path.
  • Design and operate zero-trust access controls that enforce least-privilege dynamically using device posture, user context, and behavioral signals.
  • Build short-lived, just-in-time credentialing systems for GPU clusters across AWS, GCP, and OCI.
  • Replace SSH keys and long-lived credentials with ephemeral, short-lived certificate-based access via Teleport or HashiCorp Boundary.
  • Design and enforce privileged access workflows with full audit trail.
  • Architect SPIFFE/SPIRE or cloud-native cryptographic identity frameworks for service-to-service communication across workloads.
  • Ensure dynamic, short-lived tokens for machine accounts, training jobs, and CI/CD pipelines.
  • Maintain and evolve workload identity infrastructure at scale.
  • Treat authorization policies as code using Open Policy Agent (OPA)/Rego, Cedar, or equivalent frameworks.
  • Integrate policy evaluation into developer workflows and deployment pipelines.
  • Collaborate with engineering to minimize security friction and make secure paths the simplest path.
  • Build automated provisioning and deprovisioning workflows via SCIM and API-first tooling.
  • Instrument identity telemetry with detection engineering to identify identity-related adversary techniques.
  • Improve automation coverage across the identity stack to reduce manual toil.

Qualifications

  • 15+ years of dedicated experience in identity security, security architecture, or infrastructure engineering in high-growth startups, hyperscale clouds, or elite security teams.
  • Proven track record architecting and operating modern zero-trust identity infrastructure at scale with hardware-backed authentication, JIT credentialing, and workload identity systems.
  • Hands-on experience securing IAM boundaries across AWS and GCP and containerized environments including Kubernetes identity federation and IAM roles for service accounts.
  • Experience building and operating privileged access management systems for large-scale compute environments, including GPU cluster access in cloud contexts.
  • Experience partnering with detection and response teams to instrument identity telemetry and build adversary-focused detection logic.

Skills

Required:OAuth 2.0 / OIDCGo / Python / RustTerraform / PulumiZero Trust / PAM / JIT Credentialing

Benefits

  • Top-tier compensation: Salary and equity.
  • Stock options for all joiners.
  • Health & wellness: Medical, dental, vision, life, with wellness allowance.
  • Meals: Lunch and dinner provided in the office.
  • Life & family: 22 weeks paid parental leave.
  • Vacation days: Unlimited PTO in the U.S. and 30 days in the U.K.
  • Sponsorship support: Visa sponsorship and immigration pathways where applicable.
  • Team building: Regular off-sites, happy hours, and celebrations.
Last updated Oct 1, 2026. Interested? Apply on the company site.

About Reflection

Building frontier open intelligence

Building frontier open intelligence.

liquid-ai-recruiting-target
Company profileWebsite

More open roles at Reflection