What are the responsibilities and job description for the IAM Security Engineer position at Gala Solutions?
- Central identity federated to the priority downstream systems through a canonical role model, with automated provisioning and end-to-end audit in place.
- Baseline continuous vulnerability scanning live across edge nodes and containers, with risk-scored findings flowing to the event bus.
- The edge security-telemetry pipeline designed and piloted on a representative node set — local visibility layer collecting and forwarding to the SIEM, with store-and-forward proven.
By the second half of the engagement
- Just-in-time elevation, the central policy engine, and access recertification running in production; standing administrative access eliminated.
- Agent workload identity, tool-invocation authorization, delegation, and human-approval workflows operational for sensitive actions.
- Vulnerability coverage extended across the full fleet, and identity-correlated SIEM detections live — every alert resolving to a verifiable principal.
- Documentation, runbooks, and standards handed over so the platform remains fully operable beyond the engagement.
Required qualifications
- [8 ] years in security engineering, including [3 ] years architecting identity and access management at scale.
- Deep, hands-on identity federation: enterprise identity providers, OIDC, SAML, standards-based provisioning, and mapping federated identity into downstream systems' native authorization models.
- Strong command of OAuth2/OIDC internals — scopes, audiences, token exchange, audience restriction — and common failure modes such as confused-deputy and token passthrough.
- Demonstrated implementation of an authorization policy model (RBAC plus at least one of ABAC / ReBAC) using an externalized policy engine.
- Cloud IAM depth and centralized secrets management, including automated rotation.
- Container-orchestration and container security fundamentals; able to deliver production-quality code — this role builds, not only advises.
- A track record of shipping least-privilege, just-in-time, and fully auditable access systems.
Preferred qualifications
- Securing AI agents / LLM-based systems and automated tool-invocation interfaces; prompt-injection and tool-boundary threat modeling.
- Workload identity frameworks and machine-to-machine credentialing.
- Security telemetry pipelines and SIEM integration at scale — collection, normalization, retention, and detection/correlation engineering.
- Vulnerability-management program delivery — continuous scanning, SBOM tooling, CVE correlation, and risk-based prioritization.
- Security observability on edge, IoT, or intermittently connected devices — lightweight host-based telemetry agents, store-and-forward under constrained bandwidth, and tamper-evident delivery.
- Zero-trust infrastructure access architectures; PKI, certificate lifecycle, mutual TLS, and device attestation.
- Event-driven platform security and secure CI/CD (artifact signing, infrastructure-as-code scanning, automated security gates).
- Relevant security-architecture certifications (advantageous, not required).