Principal IT Security Architect

Identity

Identity as the security perimeter (Okta).

• End-to-end review and hardening of our Okta tenant: global session and app-level authentication policies, MFA factor strength and phishing-resistant enrollment (FastPass / WebAuthn), device trust, admin role delegation and standing-privilege reduction, API token and service-app scope hygiene, SCIM lifecycle provisioning and - critically - deprovisioning, Okta Workflows, ThreatInsight, and System Log streaming into our SIEM.
• Hunt shadow admins, orphaned integrations, over-scoped OAuth grants, and legacy authentication paths.

Zscaler

Zero trust network access (Zscaler).

• Architecture and configuration review across ZIA and ZPA: SSL inspection coverage and the bypass list (where real exposure usually hides), URL and cloud-app control, DNS and firewall policy, inline DLP, sandboxing, ZPA application segments and access policies scoped to least privilege, posture profiles, App Connector and Browser Access configuration, Client Connector forwarding profiles and PAC logic, and admin RBAC on the Zscaler tenant itself.

SaaS Data Sharing and Exposure

SaaS data sharing and exposure (Google Workspace + Microsoft 365 / Entra ID / OneDrive / SharePoint).

• Exhaustive audit and remediation of external sharing: link-sharing defaults and expiry, target audiences, shared drives and site-level overrides, guest and unmanaged-device access, sensitivity labels and Purview / Google DLP rules, Entra ID Conditional Access, third-party OAuth app consent and API access controls, service account key sprawl and domain-wide delegation, and Alert Center / Defender for Cloud Apps signal quality.
• Quantify how much company data is currently shared to “anyone with the link” — and then reduce it.

Adversary-Led Validation

Adversary-led validation.

• Design and run authorized, scoped tests against our own environment: adversary-in-the-middle session hijacking, MFA fatigue and downgrade paths, OAuth consent phishing, help-desk social-engineering resistance, SaaS-to-SaaS integration abuse, and identity attack-path mapping.
• Translate every finding into a specific configuration change with an owner and a date, then purple-team the result to confirm detection actually fired.

Architecture, Standards, and Evidence

Architecture, standards, and evidence.

• Set the target-state reference architecture for identity and SaaS security, define hardening baselines against CIS Benchmarks, CISA SCuBA, and NIST SP 800-207, instrument continuous configuration-drift detection, and produce the evidence auditors, customers, and executives ask for.
• Brief the CIO and security leadership on residual risk in plain language.

Required Qualifications

• 10+ years in security engineering or architecture, a substantial portion of it hands-on-keyboard in production.
• Expert-level, in-console administration of Okta — you can explain policy evaluation order, the difference between a global session policy and an app authentication policy, and how you would detect a maliciously created app integration.
• Production experience administering Zscaler ZIA and ZPA, including the operational tradeoffs of SSL inspection, bypass exceptions, and least-privilege application segmentation.
• Deep working knowledge of both Google Workspace Admin and Microsoft 365 / Entra ID administration — specifically the sharing, external-collaboration, OAuth app-consent, and DLP surfaces.
• Demonstrated offensive capability against identity and SaaS environments. You have found real, exploitable misconfigurations, not just reported scanner output. Comfort with tooling such as BloodHound / AzureHound, ROADrecon, GraphRunner, and Burp Suite.
• Fluency in SAML, OIDC, OAuth 2.0, and SCIM — and the specific ways each is abused. Working knowledge of MITRE ATT&CK, including the cloud and SaaS matrices.
• Automation ability: Python or PowerShell against the Okta, Microsoft Graph, Google Admin SDK, and Zscaler APIs.

Preferred

• OSCP, GPEN, GCPN, GWAPT, or CRTO; Okta Certified Administrator or Consultant; Zscaler ZIA/ZPA certification.
• CISSP or CCSP is welcome but is not what we are screening for.
• Experience deploying an SSPM or CASB platform (Obsidian, AppOmni, Netskope, Defender for Cloud Apps) to automate posture review at scale.
• Experience securing AI and agentic tooling: OAuth scopes granted to AI assistants, data-access boundaries, and enterprise copilot / agent deployments.
• Detection engineering against identity telemetry in a SIEM (Splunk, Sentinel, or equivalent), and prior work in a SOX or SOC 2 audited environment.