Staff Engineer - Identity and Access Management

In Short

As a Staff Engineer – Identity and Access Management (IAM), you will serve as the principal technical authority and domain architect for the identity services powering On’s global ecosystem—spanning our workforce, partners, digital consumers, and cloud workloads.

This is a senior individual contributor (IC) role designed for an established technical leader who thrives at the intersection of deep engineering craft, cross-functional collaboration, and strategic systems architecture. You will own the technical roadmap for corporate and consumer identity, lead complex enterprise-wide security initiatives, make critical architectural trade-offs, and cultivate technical excellence across engineering and product teams without direct people management responsibilities.

• Lead Complex Strategic Initiatives:
  Drive large-scale, high-impact IAM engineering and architecture initiatives end-to-end across On’s global platforms, ensuring identity solutions deliver robust security, operational resilience, and seamless user experience.
• Harness Perspectives & Align Stakeholders:
  Actively engage with diverse viewpoints across Cybersecurity, Platform Engineering, Cloud Infrastructure, Product, Privacy, Legal, and Business Operations to forge technical alignment on complex, multi-faceted access problems.
• Anticipate Pitfalls & Navigate Trade-Offs:
  Foresee where technical, organizational, or operational friction may arise in identity life cycles and architectures, confidently balancing security controls against velocity, developer experience, and system usability.
• Proactively Share Knowledge & Coach:
  Serve as a force multiplier across the Oniverse by sharing learnings, establishing best practices, mentoring engineers and security teams, and elevating On’s collective identity security maturity through open collaboration.
• Drive Continuous Improvement:
  Challenge conventions and the status quo to eliminate technical debt and operational toil—championing modern automation, Infrastructure as Code (IaC), and Zero Trust paradigms even through unconventional or innovative paths.

• Deep IAM Craft & Production Track Record:
  You have extensive, hands-on experience designing, scaling, and operating mission-critical workforce and consumer identity architectures at a global scale.
• Cross-Discipline Systems Thinking:
  You possess a holistic perspective on software engineering, cloud environments (GCP, AWS, Azure), modern Dev Ops pipelines, and API security, understanding how identity serves as the foundation across all layers.
• Standards & Protocols Mastery:
  You demonstrate deep expertise in modern authentication, authorization, and federation mechanisms (OAuth 2.0, OpenID Connect, SAML 2.0, SCIM 2.0, Web Authn/Passkeys, and PAM patterns).
• Courage & Straightforward Candor:
  You are not afraid to tackle difficult technical challenges, challenge legacy assumptions, or surface risks early. You view technical disagreements as productive opportunities to reach better architectural outcomes.
• Relational Intelligence & Synthesis:
  You build strong, authentic relationships with technical and non-technical partners across various domains, translating intricate identity risks into practical, business-relevant solutions.
• Grit & Composure Under Pressure:
  You remain calm, focused, and solution-oriented during high-pressure incidents or complex enterprise migrations, consistently seeing commitments through to delivery.

You will join the Cybersecurity function within On’s Technology organization. We protect the human and non-human identities behind our workplace, cloud platforms, digital supply chain, and athlete/consumer experiences.

We view Identity as a product we engineer and run—not a set of disconnected gates we…