{"id":655544,"url":"https://alion.io/job/openloophealth-sr-staff-iam-architect","title":"Sr. Staff IAM Architect","company":{"id":678301,"name":"OpenLoop Health","domain":"openloophealth.com","url":"https://alion.io/company/openloophealth","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":84,"open_postings":8,"ghost_share":0,"stale_share":0.625,"repost_share":0,"time_to_fill_p50_days":34,"computed_at":"2026-10-30T05:48:23Z"}},"role":"Security","role_family":"Security","seniority":"staff","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":["Toronto, Canada"],"countries":["CA"],"hiring_countries":["US","CA"],"hiring_countries_total":2,"salary":null,"salary_estimate":{"min_usd":146000,"max_usd":260000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":114},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"Auth0","optional":false},{"name":"AWS","optional":false},{"name":"GCP","optional":false},{"name":"HIPAA","optional":false},{"name":"IAM","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Okta","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false},{"name":"Terraform","optional":false},{"name":"Azure","optional":true}],"status":"live","first_seen_at":"2026-09-08T13:36:22Z","employer_posted_date":"2026-09-15","last_verified_at":"2026-10-30T06:12:39Z","board_verified":true,"closed_at":null,"days_open":51,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":51},"description":"About OpenLoop\nOpenLoop was co-founded by CEO, Dr. Jon Lensing, and COO, Christian Williams, with the vision to bring care anywhere. Our telehealth support solutions are thoughtfully designed to streamline and simplify go-to-market care delivery for companies offering meaningful virtual support to patients across an expansive array of specialties, in all 50 states.\nAbout The Role\nOpenLoop’s mission is to bring care anywhere by powering telehealth solutions at scale. Our Identity and Access Management team governs how every person, partner, and system proves who they are and what they can reach.\nWe are hiring a Sr. Staff IAM Architect to be the design authority for identity across the company: workforce, non-employee, customer, partner, non-human, and AI agent.\nThat last one is not filler. Service accounts and AI agents are on track to outnumber the people we govern, and very few companies have a real architecture for them yet. You would own ours.\nThe platforms are chosen and in flight. Okta is our workforce IdP. SailPoint ISC and NERM are deploying for identity governance and non-employee records. Britive is deploying for privileged just-in-time access. Auth0 is our customer identity platform, procured with machine-to-machine flows in production and the interactive login experience in active build. iam-ops-hub, our identity posture and remediation platform, is built in house and deployed. What we do not have is a single design authority tying them together. Architecture currently gets decided project by project, under delivery pressure. This role exists to change that.\nThis is a hands-on architecture role, and we mean that concretely. Expect to write Auth0 Actions, Okta Workflows, and Terraform, and to query the posture warehouse yourself. Identity controls here carry HIPAA, HITRUST, and SOC 2 weight. The person who does well in this role is comfortable in ambiguity, writes decisions down, and can explain a design tradeoff to a staff engineer and to a CISO in the same week.\nWhat You’ll Do:\nOwn the target-state identity architecture across workforce, non-employee, external, non-human, and AI agent identity types, and set the standards, reference patterns, and decision records that make platform choices consistent rather than improvised per project.\n\nOwn our Auth0 customer identity architecture end to end, including tenant and organization modelling, MFA and phishing-resistant authentication, and machine-to-machine patterns, taking it from partially live to fully architected and governed across our external and partner use cases.\n\nKeep the customer and patient identity plane deliberately separate from the workforce plane, define the interfaces where the two must meet, and design the external and partner identity models for third-party developers and B2B customers.\n\nOwn the architecture for consolidating our remaining authentication paths onto a single workforce IdP, including the sequencing and patterns our engineers build against.\n\nDesign SSO, SCIM provisioning, and automated deprovisioning patterns for applications handling sensitive data, with audit evidence produced as a byproduct of the design rather than as a manual exercise.\n\nDefine the federation and directory architecture across Okta, Entra ID, AWS, and GCP, including subsidiary and acquisition integration patterns.\n\nBuild out Identity Security Posture Management, extending the posture warehouse and remediation engine we built in house, and define the metrics that tell us whether identity posture is actually improving.\n\nPartner with Security Operations and Security Architecture to design identity threat detection and response into our existing SIEM rather than a parallel stack.\n\nDesign access controls that satisfy HIPAA, HITRUST, and SOC 2 requirements without adding manual overhead, and keep architecture documentation and control mappings current enough that supporting an audit is a lookup rather than a project.\n\nServe as the design authority between the function that surfaces identity risk and the function that builds, so that every finding has a clear architectural path to remediation.\n\nWho You Are:\nAn architect who still builds. You would rather write the reference implementation than describe it.\n\nA writer. You document decisions so they survive your absence, and you would rather be disagreed with in writing than agreed with in a hallway.\n\nComfortable owning direction without owning headcount, and effective at getting engineering teams to adopt your patterns because they are good, not because you outrank anyone.\n\nEnergized by finishing half-built things. Much of this estate is in flight, not greenfield.\n\nRequired Qualifications\n8+ years in identity and access management, security engineering, or platform architecture, with at least 3 years at a staff, principal, or architect level.\n\nDeep, hands-on customer identity experience. You have designed and delivered a CIAM platform end to end on Auth0, including tenant and organization modelling, MFA, and machine-to-machine authentication.\n\nStrong command of federation and authentication protocols: SAML, OIDC, OAuth 2.0, SCIM, WebAuthn and FIDO2.\n\nEnterprise workforce IdP architecture experience, on Okta or equivalent, including migrations off legacy or fragmented authentication sources.\n\nDemonstrated ability to set architectural direction and get engineering teams to adopt it without direct authority.\n\nClear written communication, including architecture decision records and reference designs.\n\nPreferred Qualifications\nDesigning for HIPAA and PHI safeguards, or comparable regulated-industry access requirements.\n\nIdentity governance depth: joiner-mover-leaver lifecycle, RBAC, access certification, segregation of duties. Experience with SailPoint ISC and NERM or comparable IGA and non-employee lifecycle platforms.\n\nCloud PAM and zero standing privilege models, particularly Britive or similar just-in-time access tooling.\n\nCloud-native identity across AWS, GCP, and Azure, including migrations off cloud-provider user pools such as AWS Cognito, or off social and directory sign-in such as Google Sign-In.\n\nBuilding Identity Security Posture Management or identity threat detection capability, including SIEM integration for identity telemetry.\n\nNon-human identity, service account governance, secrets management, or AI agent identity.\n\nInfrastructure as code for identity, including Terraform.\n\nHITRUST, SOC 2, or SOX access controls.\n\nCertifications such as CISSP or CISSP-ISSAP, CISM, TOGAF or SABSA, Okta Certified Consultant or Architect, Auth0, SailPoint, or a professional-level cloud architect certification.\n\nDigital health, telehealth, or another regulated high-growth environment.\n\nWhat Success Looks Like:\nA target-state identity architecture approved, published, and adopted, with decision records for every material choice.\n\nOur customer identity architecture complete, and the interactive login plane delivered to production across external and partner use cases.\n\nA published consolidation architecture that engineering builds against, with measurable movement of our application portfolio onto a single workforce IdP.\n\nAn Identity Security Posture Management baseline in production: metrics defined and instrumented, continuous drift alerting live, and the highest-severity findings shrinking.\n\nAudit evidence produced as a byproduct of design, with control mappings traceable directly to architecture documents.\n\nOur Benefits\nIn addition, for salaried positions you would also be eligible for:\nMedical, Dental, and Vision plans\n\nFlexible Spending/Health Savings Accounts\n\nFlexible PTO\n\n401(k) + Company Match\n\nLife Insurance, Pet insurance, and more\n\nOur Company\nWe have a relatively flat organizational structure here at OpenLoop. Everyone is encouraged to bring ideas to the table and make things happen. This fits in well with our core values of Autonomy, Competence and Belonging, as we want everyone to feel empowered and supported to do their best work.\nSound like a good fit? We’d love to meet you.","description_format":"text","description_chars":8034,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Life insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"},{"name":"Canada","iso":"CA","kind":"country"},{"name":"Toronto","iso":null,"kind":"city"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Telemedicine & Virtual Care","Pharmacies"],"lifecycle":[{"event":"open","at":"2026-09-10T20:52:58Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 2","filings_12m":2,"filings_prev_12m":0,"green_card_filings_12m":0,"median_offered_wage_usd":172500,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":40,"band":"fade","label":"Fading","p_open":1,"p_active":0.885,"p_room":0.45,"age_days":51,"expected_fill_days":34,"reasons":["conf:3","velocity","win:tail"],"computed_at":"2026-10-30T05:48:23Z"},"pay":null,"html_url":"https://alion.io/job/openloophealth-sr-staff-iam-architect","json_url":"https://alion.io/job/openloophealth-sr-staff-iam-architect.json","meta":{"generated_at":"2026-10-30T06:22:38Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8833,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-31T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":678301},"rest":"https://alion.io/mcp/rest/get_company?id=678301"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fopenloophealth-sr-staff-iam-architect"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fopenloophealth-sr-staff-iam-architect"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fopenloophealth-sr-staff-iam-architect"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/openloophealth-sr-staff-iam-architect\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fopenloophealth-sr-staff-iam-architect"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":655544}},{"tool":"search_jobs","arguments":{"company":"openloophealth.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":655544},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}