Staff IT Engineer

Job Overview

In this role, you will own Headway’s identity and access strategy and roadmap, guide architecture decisions, lead organization-wide RBAC and least-privilege initiatives, improve identity automation and reliability, and act as a senior technical resource for leadership and engineers.

Key Responsibilities

• Set the multi-year direction for identity and access at Headway, including IAM strategy, lifecycle management, joiner-mover-leaver automation, and identity provider architecture.
• Represent identity and access in company-wide engineering and security strategy and advise leadership on future technical direction.
• Resolve complex architectural problems across identity, endpoint, security, and the broader IT platform.
• Design integration patterns involving APIs, SCIM, OIDC, SAML, RBAC, and device-to-identity trust.
• Lead the organization-wide transition to least-privilege and role-based access control as a technical change program.
• Define the RBAC model, sequence rollout plans, manage user impact, and drive adoption across teams.
• Architect provisioning, de-provisioning, and access-change automation that reduces manual operational work at scale.
• Set engineering standards and guardrails for identity integrations and automation.
• Own major identity incidents from response through postmortem and convert lessons learned into long-term reliability and control improvements.
• Mentor engineers across IT Engineering and establish documentation, quality, and technical standards.
• Advise leadership on identity and access risk, tooling, and investment priorities.

Required Qualifications

• 7+ years of experience in IAM or identity engineering within fast-paced SaaS environments supporting a distributed workforce.
• Deep expertise with Okta.
• Broad technical knowledge across endpoint management, security, and IT platforms sufficient to lead beyond identity-specific work.
• Experience defining technical strategy and architecture for identity programs rather than only implementing individual workflows.
• Experience with joiner-mover-leaver automation and SaaS integrations using APIs, SCIM, OIDC, and SAML.
• Experience leading organization-wide access-control or RBAC deployments as the technical owner.
• Ability to establish technical standards, guardrails, and documentation practices that can be followed by other engineers.
• Experience presenting technical decisions and tradeoffs to senior stakeholders and leadership.
• Experience mentoring and developing engineers and contributing to team culture, hiring, and onboarding.
• Experience leading incident response and reliability improvements for identity-critical systems.
• Ability to work autonomously, plan group-level initiatives, and maintain visibility into execution.
• Current knowledge of identity and privacy best practices in regulated environments involving HIPAA, SOC 2, and HITRUST.

Technology Stack

• Identity & Access Management: Okta, Lumos
• Email & Messaging: Gmail, Slack
• Collaboration: Google Workspace, Confluence
• Credential Management: 1Password
• Ticketing: Jira Service Desk, ZenDesk, Jira Projects
• Project Planning: Jira
• Endpoint Management: Iru, InTune, ChromeOS, Kolide

Compensation & Benefits

The listed annual compensation range for this position is $180,000–$225,000. Headway also states that the role offers equity.

The company describes its total rewards package as including health and wellness benefits, retirement savings, and ownership opportunities through equity. Specific benefit amounts or plan details are not provided in the supplied listing.

Work Environment & Compliance

This position supports a distributed workforce and operates within a regulated environment involving HIPAA, SOC 2, and HITRUST considerations.

Headway participates in E-Verify. The employer also states that reasonable accommodations are available for qualified individuals who need support during the application or interview process or in performing essential job functions.

Application Security Notice

Headway states that it accepts applications through its official careers process and warns applicants against recruitment fraud. Official company communications are stated to come from a @findheadway.com email address. Applicants should not provide information or payment through unofficial recruiting channels.