Senior Security Engineer - Workforce Security - Identity, Access and Authorization

Overview

Are you passionate about security engineering, identity, and the cloud?

Come join the Enterprise Identity & Access Management team as a Senior Security Engineer. We build and operate the systems that decide who can access what across Intuit's cloud footprint, and we are rebuilding them for a world where access decisions need to be fine-grained, real-time, and provable.

This is a hands-on building role. You will spend the majority of your time in code and in system design, not in coordination. You will own cloud access management, meaning how humans and workloads get, use, and give up access to AWS and GCP, and fine-grained access controls: policy-as-code, authorization services, and entitlement models that replace coarse role checks with decisions we can actually reason about and prove. You will also help us stand up authentication for workforce agentic identity, an area where the industry does not yet have settled answers and you will help define ours.

The work is full-stack. You will design and build the back-end services and policy engines that make authorization decisions, and the front-end experiences that let engineers, access approvers, and auditors understand and act on them. What makes this a security engineering role rather than a general platform role is that the control is the product: correctness, blast radius, and evidence are the requirements, not afterthoughts.

Responsibilities

Design and build

• Lead design and delivery of complex cloud access management and fine-grained authorization services, owning the outcome independently.

• Build back-end services, APIs, and policy evaluation paths in Java and Spring, with Python for automation and agent work, and React front-ends.

• Design authorization models that hold up in practice: ABAC, relationship-based access control, policy-as-code, just-in-time and time-bound access, workload identity, and true least privilege.

• Integrate deeply with AWS IAM/STS, GCP IAM, cross-account access, and SAML, OIDC, and OAuth 2.0.

• Lead security technology evaluations with long-term implications, and make the internal case for approaches worth adopting.

Own the security outcome

• Find root causes of complex security risks rather than patching symptoms.

• Evaluate, report, and remediate access control gaps, and define remediation guidance other teams follow. Pair data with a clear narrative.

• Threat model what you build: privilege escalation, confused deputy, token replay, policy bypass, and dependency compromise.

• Automate control testing and continuous evidence collection for SOX logical access and other regulatory controls. Manual evidence gathering is a bug.

• Own observability, alerting, and monitoring after release, not just at launch.

Use AI as part of the craft

• Integrate GenAI tooling and orchestrate agents across design, development, validation, and operations, holding their output to the same review and testing bar as your own.

• Apply the same security rigor to AI systems, particularly as we build the identity and authorization layer agents will run on.

Execute and lead

• Provide reliable estimates that account for technical risk and team capacity, balancing speed to learn against long-term system health.

• Eliminate systemic roadblocks through cross-functional influence and shape practices that keep quality consistent.

• Own delivery of major projects, managing risks and updating stakeholders before they ask.

• Partner with Product, Design, and internal customers to co-define requirements from inception.

• Define success upfront, track adoption and impact after launch, and drive follow-up iterations.

Elevate the team

• Give actionable feedback on security practices, design, and collaboration, and contribute to teammates’ learning plans.

• Provide clarity amid ambiguity, resolving technical constraints by grounding discussion in customer problems, security principles, and established patterns.

• Surface unresolved challenges to Staff-plus engineers and management early enough to act.

Qualifications

Qualifications

• 5+ years of professional experience building and shipping production software, with meaningful time spent on security-relevant systems.

• Full-stack development experience:

• Back end: Java and Spring, plus Python for automation, tooling, and AI/agent work

• Front end: React (Angular acceptable)

• Deep hands-on experience with AWS or GCP, including its identity and access primitives, and a working understanding of how cloud permission models fail in practice.

• Production experience with identity and access management: RBAC or ABAC, SSO, federation (SAML), OIDC, OAuth 2.0, and token and credential lifecycle.

• Demonstrated ability to root-cause complex security issues through in-depth analysis rather than pattern matching.

• Strong automation instincts, including experience automating control testing, evidence collection, or compliance workflows.

• Datastore and database experience, including schema and query design under real scale and latency constraints.

• Experience using AI developer tools and agents in your engineering workflow, including validating their output before it ships.

• Strong written and verbal communication. You will be explaining authorization decisions and security trade-offs to people who did not design the system, including non-engineers.

• BS/MS in Computer Science, a related field, or equivalent practical experience.

Strongly Preferred Experience

• Fine-grained authorization at scale: policy-as-code with OPA and Rego, AWS Cedar, Zanzibar-style relationship-based authorization, XACML, or a purpose-built decision service.

• Cloud entitlement management: AWS IAM policy analysis, permission boundaries, GCP IAM conditions, workload identity federation, and secrets or credential brokering.

• Identity governance: access certification, separation of duties, privileged access management, and least-privilege analysis over real entitlement data.

• SOX or other regulatory logical access controls, including audit evidence automation and continuous control monitoring.

• Threat modeling and secure design review as a regular practice, not an occasional exercise.

• Machine and non-human identity: service accounts, workload identity, and the emerging problem of giving AI agents scoped, revocable, auditable access.

• Building AI-native applications or applying LLMs and agent frameworks to real production problems.

• Agile, Scrum, or Extreme Programming experience.

• A GitHub portfolio or open source contributions you are proud to share.

Intuit provides a competitive compensation package with a strong pay for performance rewards approach. This position may be eligible for a cash bonus, equity rewards and benefits, in accordance with our applicable plans and programs (see more about our compensation and benefits at Intuit®: Careers | Benefits (https://www.intuit.com/careers/benefits/full-time-employees/) ). Pay offered is based on factors such as job-related knowledge, skills, experience, and work location. To drive ongoing fair pay for employees, Intuit conducts regular comparisons across categories of ethnicity and gender.

The expected base pay range for this position is:

San Diego $161,000 - $218,000

EOE AA M/F/Vet/Disability. Intuit will consider for employment qualified applicants with criminal histories in a manner consistent with requirements of local law.