Staff IT Engineer

About the role

Identity and access is foundational to how Headway operates securely at scale. In this role you will set the direction for our identity and access program, resolve the hardest architectural problems where identity, endpoint, security, and the broader IT platform intersect, and raise the technical bar for the engineers around you. You will be deepest in IAM, but you will lead well beyond it.

Responsibilities

• Set the multi-year direction for identity and access at Headway.
• Own the IAM strategy and roadmap (lifecycle, JML automation, IdP architecture) as a group-level program tied to business outcomes, not just a set of workflows to run.
• Represent identity in company-wide engineering and security strategy. Bring a point of view to architecture and platform decisions, and be the person leadership consults on where identity and access should go next.
• Resolve the hard, cross-domain architectural problems where identity, endpoint, security, and the broader IT platform intersect: API/SCIM/OIDC/SAML integration design, RBAC modeling, and device-to-identity trust. Set the patterns other engineers build on.
• Lead the org-wide move to least-privilege / RBAC as a change program: define the model, sequence the rollout, manage user impact, and drive cross-functional adoption across pods so it actually sticks.
• Raise the automation and reliability bar. Architect provisioning, de-provisioning, and access-change automation that eliminates manual toil at scale, and set the standards and guardrails the team builds against, rather than just authoring individual integrations.
• Own major identity incidents end-to-end. Lead response and postmortems for high-severity identity and access events and turn the learnings into durable reliability and control improvements.
• Level up the team. Mentor engineers across IT Engineering, set documentation and quality standards, and advise leadership on identity and access risk, tooling, and investment.

Requirements

• 7+ years in IAM / identity engineering in fast-paced SaaS environments supporting a distributed workforce, with deep Okta expertise, and enough breadth across endpoint, security, and IT platform to lead beyond identity alone.
• Have defined the technical strategy and architecture for identity programs, not just implemented them, including JML automation and SaaS integration via APIs, SCIM, and OIDC/SAML.
• Have led organization-wide access-control or RBAC deployments as the technical owner, driving cross-functional alignment and managing user impact at scale.
• Set standards other engineers follow. You've established patterns, guardrails, and documentation practices that outlast any single project.
• Represent technical decisions to senior stakeholders and leadership, synthesizing complex tradeoffs into clear direction that drives business efficiency.
• Mentor and grow other engineers, and actively shape team culture, hiring, and onboarding.
• Lead incident response and reliability improvements for identity-critical systems.
• Operate with autonomy and methodical ownership, planning and executing group-level work with visibility, and stay current on identity and privacy best practices in a regulated (HIPAA / SOC 2 / HITRUST) environment.

Tools We Use

• Identity and Access Management: Okta, Lumos
• Email and Messaging: Gmail and Slack
• Document Creation and Collaboration: Google Workspace, Confluence
• Credential Management: 1Password
• Ticketing: Jira Service Desk, ZenDesk, Jira Projects
• Project Planning: Jira
• Endpoint Management: Iru, InTune, ChromeOS, Kolide

Pay

Compensation Range: $180K - $225K