We’re seeking an experienced Senior Security Engineer with a strong passion for Identity and Access Management (IAM) and proven expertise in cloud‑native environments, particularly AWS . In this role, you’ll help shape and implement modern identity strategies to secure access across all Marqeta’s systems and services—100% cloud‑based, with no data center footprint. Responsibilities Building and evolving our Identity Governance and Administration (IGA) capabilities. Implementing & operating Privileged Access Management (PAM) in an AWS‑focused environment. Designing and architecting a Certificate Lifecycle Management solution that supports cloud‑native workloads. Driving integration of IAM across AWS services, SaaS platforms, and developer/DevOps pipelines. Designing identity and access controls to protect AI/ML systems—including secure access to training data, models, and inference APIs. The impact you’ll have Develop and lead implementation of robust IAM strategies aligned with cloud‑native architecture and security principles. Expand and operationalize the IAM program across IGA, PAM, SSO, MFA, access management, secrets management, and certificate lifecycle. Automate identity provisioning, de‑provisioning, and access reviews using AI tools and infrastructure‑as‑code. Design IAM integrations for AWS‑native services (Lambda, EC2, S3, IAM, etc.), SaaS platforms, and third‑party identity tools (e.g., Okta, CyberArk). Promote and enforce least privilege and zero‑trust principles through scalable access controls and policy automation. Mentor junior engineers and serve as a technical lead for IAM‑related projects. Collaborate with Security, DevOps, and Infrastructure teams to embed IAM controls across the engineering lifecycle. Stay ahead of emerging trends and continuously refine IAM strategy based on evolving cloud threats and compliance requirements. Qualifications A minimum of 8 years related experience with a Bachelor's degree; or 5 years and a Master's degree; or a PhD with 3 years’ experience; or equivalent combination. Strong experience with IAM tools (e.g., Okta, CyberArk, Ping, SailPoint). Deep knowledge of IAM in cloud‑native environments, especially AWS IAM, roles, policies, permissions boundaries, and federation. Proficiency in infrastructure‑as‑code (e.g., Terraform, CloudFormation). Familiarity with authentication and authorization protocols (SAML, OAuth2, OpenID Connect, Kerberos). Strong grasp of directory services like Active Directory, LDAP, and cloud‑based alternatives. Hands‑on skills in scripting (e.g., Python, PowerShell) to automate IAM operations. Solid understanding of compliance standards: NIST, SOC 2, PCI DSS, etc. Proven experience integrating IAM into CI/CD pipelines, secrets management, and DevOps workflows. Excellent communication skills and ability to influence and lead cross‑functional teams. Nice to have Relevant certifications such as CISSP, CISM, or IAM‑specific credentials (e.g., CIAM/CAMS, CyberArk Certified, Okta Certified Consultant). Experience with AWS technologies such as Lambda, S3, DynamoDB, RDS, Aurora, SNS, SQS, CloudTrail, CloudWatch, CodePipeline, AWS Developer Tools, and IAM roles and permissions. Experience with DevOps tools and practices, including secrets management and CI/CD pipelines. Compensation and Benefits Marqeta is a Flex First company that allows you to choose your best working environment, whether from home or at a company office. Pay is calibrated to a competitive value based on location and skills. New‑hire base salary range (CAD): 136,800 – 171,000. Annual bonuses for eligible employees and multiple health insurance options. Flexible vacation time Retirement savings program with company contribution Equity in a publicly‑traded company Monthly stipend to support remote work model Annual “development dollars” to support growth and development Family‑forming benefits and up to 20 weeks of parental leave Equal Employment Opportunity Marqeta is an equal opportunity employer committed to an inclusive workplace that fosters belonging. We do not discriminate based on race, color, religion, sex, veteran status, age, national origin or ancestry, citizenship or immigration status, physical or mental disability, gender identity, gender expression, sexual orientation, genetic information or any other characteristic protected by applicable law. We also consider qualified applicants with criminal histories, consistent with legal requirements. Marqeta endeavors to make reasonable accommodations for applicants with disabilities. #J-18808-Ljbffr