Principal Identity Architect

Overview

As a Principal Identity Architect, you will lead Epsilon’s identity modernization—transitioning from legacy SAML and long-lived credentials to a modern, OAuth 2.1 / OpenID Connect (OIDC)-first model. You’ll design secure, scalable identity patterns across multi-cloud environments while enabling teams to build with speed and confidence.

You’ll partner closely with Security, Cloud, Platform, and Engineering teams to replace API keys and service accounts with scoped, ephemer ial machine identities, establish enterprise standards, and deliver secure, developer-friendly integrations.

This is a hands‑on leadership role for someone who can drive strategy, mentor engineers, and turn architecture into real‑world implementations.

• Lead adoption of OAuth 2.1 / OIDC; drive migration from SAML and legacy auth
• Design secure token flows (Auth Code + PKCE, Client Credentials, delegated access)
• Define standards for token usage, scopes, claims, and lifecycle management
• Reduce risk from token leakage, replay, and over-permissioning

• Replace long-lived credentials with modern machine identity patterns
• Design M2M authentication for APIs, data pipelines, and platform workloads
• Partner with teams on service account migration and secrets reduction

• Build reusable identity patterns across IdPs, API gateways, and cloud platforms
• Enable secure, scalable access across AWS, Azure, and/or GCP
• Troubleshoot complex auth issues in hybrid and multi-cloud environments

• Apply Zero Trust principles (least privilege, scoped access)
• Improve identity logging, monitoring, and audit readiness
• Establish governance for OAuth apps, scopes, and access policies

• Drive identity modernization programs end-to-end
• Mentor architects and engineers; set technical standards
• Break down complex initiatives into actionable work streams
• Lead incident response and improve operational visibility

• Bachelors or Masters in Computer Science or related field.
• 7+ years in IAM, security engineering, or platform roles
• 3+ years hands-on with OAuth 2.0 / OIDC in production
• Strong expertise in token flows, scopes, claims, and secure design patterns
• Experience implementing machine identity (M2M, workload identity, etc.)
• Track record of modernizing identity (SAML → OIDC or similar)
• Experience with AWS, Azure, or GCP identity services
• Ability to lead initiatives, influence teams, and deliver at scale

• Experience with API security, data platforms, or service-to-service auth at scale
• Familiarity with SPIFFE/SPIRE, OPA, or advanced authorization models
• Experience with Okta, Entra  (Azure AD), Auth0, or Ping
• Exposure to AI/agent-based identity patterns
• Scripting or automation (Python, Bash)

When you join Epsilon, we’ll create something EPIC together.We’re a global leader in data and identity, with deep expertise in digital media, clean rooms, customer data platforms, loyalty and marketing services. Positioned at the center of Publicis Groupe, Epsilon helps brands deliver personalized experiences at scale and build lasting customer relationships by unlocking the full potential of data and identity. Epsilon operates in 30+ countries across EMEA, the Americas and APAC, with more than 8,000 employees.

Check out a few of these resources to learn more about what makes Epsilon so EPIC:

Our Culture:

Life at Epsilon:

Epsilon has five values that define our culture and guide us as we create value for our clients, our people and consumers. We seek candidates who align with our company values, demonstrate them…