Principal Identity Architect

Key details

Full job description

Epsilon is hiring a Principal Identity Architect to lead identity modernization by transitioning from legacy SAML and long-lived credentials to OAuth 2.1 / OpenID Connect (OIDC). The role involves designing secure, scalable identity patterns across multi-cloud environments (AWS, Azure, GCP), replacing API keys and service accounts with scoped, ephemeral machine identities, and establishing enterprise standards. Responsibilities include leading OAuth 2.1/OIDC adoption, designing token flows, defining token standards, reducing token risks, implementing machine identity for APIs and workloads, building reusable identity patterns, applying Zero Trust principles, improving identity governance and observability, mentoring engineers, and leading incident response. Requirements include a Bachelor’s or Master’s in Computer Science or related field, 7+ years in IAM/security engineering/platform roles, 3+ years hands-on OAuth 2.0/OIDC experience, expertise in token flows and secure design, experience with machine identity and cloud identity services, and leadership ability. Preferred skills include API security, SPIFFE/SPIRE, OPA, Okta, Auth0, Ping, AI-based identity patterns, and scripting (Python, Bash). Salary range is USD $127,900 to $237,500 annually. Locations: Irving, Texas; Chicago, Illinois; Westminster, Colorado.