Senior Security Engineer - Workforce Security - Identity, Access and Authorization

Are you passionate about security engineering, identity, and the cloud?

Come join the Enterprise Identity & Access Management team as a Senior Security Engineer. We build and operate the systems that decide who can access what across Intuit's cloud footprint, and we are rebuilding them for a world where access decisions need to be fine-grained, real-time, and provable.

This is a hands-on building role. You will spend the majority of your time in code and in system design, not in coordination. You will owncloud access management, meaning how humans and workloads get, use, and give up access to AWS and GCP, andfine-grained access controls: policy-as-code, authorization services, and entitlement models that replace coarse role checks with decisions we can actually reason about and prove.

You will also help us stand up authentication for workforce agentic identity, an area where the industry does not yet have settled answers and you will help define ours.

The work is full-stack. You will design and build the back-end services and policy engines that make authorization decisions, and the front-end experiences that let engineers, access approvers, and auditors understand and act on them. What makes this a security engineering role rather than a general platform role is that the control is the product: correctness, blast radius, and evidence are the requirements, not afterthoughts.

• Lead design and delivery of complex cloud access management and fine-grained authorization services, owning the outcome independently.
• Build back-end services, APIs, and policy evaluation paths in Java and Spring, with Python for automation and agent work, and React front-ends.
• Design authorization models that hold up in practice: ABAC, relationship-based access control, policy-as-code, just-in-time and time-bound access, workload identity, and true least privilege.
• Integrate deeply with AWS IAM/STS, GCP IAM, cross-account access, and SAML, OIDC, and OAuth 2.0.
• Lead security technology evaluations with long-term implications, and make the internal case for approaches worth adopting.

• Find root causes of complex security risks rather than patching symptoms.
• Evaluate, report, and remediate access control gaps, and define remediation guidance other teams follow. Pair data with a clear narrative.
• Threat model what you build: privilege escalation, confused deputy, token replay, policy bypass, and dependency compromise.
• Automate control testing and continuous evidence collection for SOX logical access and other regulatory controls. Manual evidence gathering is a bug.
• Own observability, alerting, and monitoring after release, not just at launch.

• Integrate GenAI tooling and orchestrate agents across design, development, validation, and operations, holding their output to the same review and testing bar as your own.
• Apply the same security rigor to AI systems, particularly as we build the identity and authorization layer agents will run on.

• Provide reliable estimates that account for technical risk and team capacity, balancing speed to learn against long-term system health.
• Eliminate systemic roadblocks through cross-functional influence and shape practices that keep quality consistent.
• Own delivery of major projects, managing risks and updating stakeholders before they ask.
• Partner with Product, Design, and internal customers to co-define requirements from inception.
• Define success upfront, track adoption and impact after launch, and drive follow-up iterations.

• Give actionable feedback on security practices, design, and collaboration, and contribute to teammates’ learning plans.
• Provide clarity amid ambiguity, resolving…