{"id":3368492,"url":"https://alion.io/job/intuit-senior-security-engineer-workforce-security-identity-access-and-authorization","title":"Senior Security Engineer - Workforce Security - Identity, Access and Authorization","company":{"id":16628,"name":"Intuit","domain":"intuit.com","url":"https://alion.io/company/intuit","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Radancy","truth_index":{"grade":"B","score":78,"open_postings":56,"ghost_share":0,"stale_share":0.857,"repost_share":0.018,"time_to_fill_p50_days":40,"computed_at":"2026-10-29T05:49:05Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Diego, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":161000,"max":218000,"currency":"USD","period":"year","gross":null,"usd_annual":218000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Angular","optional":false},{"name":"AWS","optional":false},{"name":"GCP","optional":false},{"name":"IAM","optional":false},{"name":"Java","optional":false},{"name":"Least Privilege","optional":false},{"name":"Python","optional":false},{"name":"Agile","optional":true},{"name":"AI Agents","optional":true},{"name":"GitHub","optional":true},{"name":"JavaScript","optional":true},{"name":"Scrum","optional":true},{"name":"Threat Modeling","optional":true},{"name":"TypeScript","optional":true}],"status":"live","first_seen_at":"2026-10-15T00:00:00Z","employer_posted_date":"2026-10-15","last_verified_at":"2026-10-29T11:19:42Z","board_verified":true,"closed_at":null,"days_open":14,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":14},"description":"Are you passionate about security engineering, identity, and the cloud?\nCome join the Enterprise Identity & Access Management team as a Senior Security Engineer. We build and operate the systems that decide who can access what across Intuit's cloud footprint, and we are rebuilding them for a world where access decisions need to be fine-grained, real-time, and provable.\nThis is a hands-on building role. You will spend the majority of your time in code and in system design, not in coordination. You will own cloud access management, meaning how humans and workloads get, use, and give up access to AWS and GCP, and fine-grained access controls: policy-as-code, authorization services, and entitlement models that replace coarse role checks with decisions we can actually reason about and prove. You will also help us stand up authentication for workforce agentic identity, an area where the industry does not yet have settled answers and you will help define ours.\nThe work is full-stack. You will design and build the back-end services and policy engines that make authorization decisions, and the front-end experiences that let engineers, access approvers, and auditors understand and act on them. What makes this a security engineering role rather than a general platform role is that the control is the product: correctness, blast radius, and evidence are the requirements, not afterthoughts.\nResponsibilities\nDesign and build\nLead design and delivery of complex cloud access management and fine-grained authorization services, owning the outcome independently.\nBuild back-end services, APIs, and policy evaluation paths in Java and Spring, with Python for automation and agent work, and React front-ends.\nDesign authorization models that hold up in practice: ABAC, relationship-based access control, policy-as-code, just-in-time and time-bound access, workload identity, and true least privilege.\nIntegrate deeply with AWS IAM/STS, GCP IAM, cross-account access, and SAML, OIDC, and OAuth 2.0.\nLead security technology evaluations with long-term implications, and make the internal case for approaches worth adopting.\nOwn the security outcome\nFind root causes of complex security risks rather than patching symptoms.\nEvaluate, report, and remediate access control gaps, and define remediation guidance other teams follow. Pair data with a clear narrative.\nThreat model what you build: privilege escalation, confused deputy, token replay, policy bypass, and dependency compromise.\nAutomate control testing and continuous evidence collection for SOX logical access and other regulatory controls. Manual evidence gathering is a bug.\nOwn observability, alerting, and monitoring after release, not just at launch.\nUse AI as part of the craft\nIntegrate GenAI tooling and orchestrate agents across design, development, validation, and operations, holding their output to the same review and testing bar as your own.\nApply the same security rigor to AI systems, particularly as we build the identity and authorization layer agents will run on.\nExecute and lead\nProvide reliable estimates that account for technical risk and team capacity, balancing speed to learn against long-term system health.\nEliminate systemic roadblocks through cross-functional influence and shape practices that keep quality consistent.\nOwn delivery of major projects, managing risks and updating stakeholders before they ask.\nPartner with Product, Design, and internal customers to co-define requirements from inception.\nDefine success upfront, track adoption and impact after launch, and drive follow-up iterations.\nElevate the team\nGive actionable feedback on security practices, design, and collaboration, and contribute to teammates’ learning plans.\nProvide clarity amid ambiguity, resolving technical constraints by grounding discussion in customer problems, security principles, and established patterns.\nSurface unresolved challenges to Staff-plus engineers and management early enough to act.\nQualifications\nQualifications\n5+ years of professional experience building and shipping production software, with meaningful time spent on security-relevant systems.\n\nFull-stack development experience:\nBack end: Java and Spring, plus Python for automation, tooling, and AI/agent work\n\nFront end: React (Angular acceptable)\n\nDeep hands-on experience with AWS or GCP, including its identity and access primitives, and a working understanding of how cloud permission models fail in practice.\n\nProduction experience with identity and access management: RBAC or ABAC, SSO, federation (SAML), OIDC, OAuth 2.0, and token and credential lifecycle.\n\nDemonstrated ability to root-cause complex security issues through in-depth analysis rather than pattern matching.\n\nStrong automation instincts, including experience automating control testing, evidence collection, or compliance workflows.\n\nDatastore and database experience, including schema and query design under real scale and latency constraints.\n\nExperience using AI developer tools and agents in your engineering workflow, including validating their output before it ships.\n\nStrong written and verbal communication. You will be explaining authorization decisions and security trade-offs to people who did not design the system, including non-engineers.\n\nBS/MS in Computer Science, a related field, or equivalent practical experience.\n\nStrongly Preferred Experience\nFine-grained authorization at scale: policy-as-code with OPA and Rego, AWS Cedar, Zanzibar-style relationship-based authorization, XACML, or a purpose-built decision service.\n\nCloud entitlement management: AWS IAM policy analysis, permission boundaries, GCP IAM conditions, workload identity federation, and secrets or credential brokering.\n\nIdentity governance: access certification, separation of duties, privileged access management, and least-privilege analysis over real entitlement data.\n\nSOX or other regulatory logical access controls, including audit evidence automation and continuous control monitoring.\n\nThreat modeling and secure design review as a regular practice, not an occasional exercise.\n\nMachine and non-human identity: service accounts, workload identity, and the emerging problem of giving AI agents scoped, revocable, auditable access.\n\nBuilding AI-native applications or applying LLMs and agent frameworks to real production problems.\n\nAgile, Scrum, or Extreme Programming experience.\n\nA GitHub portfolio or open source contributions you are proud to share.\n\nIntuit provides a competitive compensation package with a strong pay for performance rewards approach. This position may be eligible for a cash bonus, equity rewards and benefits, in accordance with our applicable plans and programs (see more about our compensation and benefits at Intuit®: Careers | Benefits). Pay offered is based on factors such as job-related knowledge, skills, experience, and work location. To drive ongoing fair pay for employees, Intuit conducts regular comparisons across categories of ethnicity and gender.\n The expected base pay range for this position is:San Diego $161,000 - $218,000","description_format":"text","description_chars":7087,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Personal Finance Apps & Education","Accounting & Tax Software","Tax Advisory & Preparation"],"lifecycle":[{"event":"open","at":"2026-10-28T00:02:22Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 719 · green card filings: 199","filings_12m":719,"filings_prev_12m":718,"green_card_filings_12m":199,"median_offered_wage_usd":177081,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":25}],"liveness":{"score":56,"band":"ok","label":"Likely open","p_open":1,"p_active":0.622,"p_room":0.9,"age_days":14,"expected_fill_days":40,"reasons":["conf:2","stale_co","velocity","win:mid","comp:brand"],"computed_at":"2026-10-29T05:49:05Z"},"pay":{"stated_usd_annual":218000,"is_top_pay":true},"html_url":"https://alion.io/job/intuit-senior-security-engineer-workforce-security-identity-access-and-authorization","json_url":"https://alion.io/job/intuit-senior-security-engineer-workforce-security-identity-access-and-authorization.json","meta":{"generated_at":"2026-10-29T12:12:15Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":18237,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-30T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":16628},"rest":"https://alion.io/mcp/rest/get_company?id=16628"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fintuit-senior-security-engineer-workforce-security-identity-access-and-authorization"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fintuit-senior-security-engineer-workforce-security-identity-access-and-authorization"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fintuit-senior-security-engineer-workforce-security-identity-access-and-authorization"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/intuit-senior-security-engineer-workforce-security-identity-access-and-authorization\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fintuit-senior-security-engineer-workforce-security-identity-access-and-authorization"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3368492}},{"tool":"search_jobs","arguments":{"company":"intuit.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3368492},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}