MTS Lead, Identity and Access Management

About the role

Reflection is a research lab building open AI models. The Head of Identity and Access Management will design, build, and operate a cutting‑edge, zero‑trust identity infrastructure that protects researchers and massive compute environments while remaining developer‑friendly.

Key responsibilities

• Design and implement a cloud‑native IAM architecture using modern IdPs (Okta, OIDC/OAuth 2.0) and zero‑trust access networks (Cloudflare Access, Tailscale/WireGuard).
• Mandate hardware‑backed, phishing‑resistant authentication (YubiKeys/WebAuthn) and eliminate legacy MFA methods.
• Build just‑in‑time, short‑lived credentialing for GPU cluster access across AWS, GCP and OCI, replacing SSH keys with tools like Teleport or HashiCorp Boundary.
• Architect workload and machine identity using SPIFFE/SPIRE and ensure dynamic token usage for services, CI/CD pipelines and training jobs.
• Implement policy‑as‑code with OPA/Rego or Cedar and integrate it into developer workflows.
• Automate provisioning/de‑provisioning via SCIM and API‑first tooling, and work with detection teams to instrument identity telemetry.

Required profile

• 15+ years of experience in identity security, security architecture or infrastructure engineering.
• Proven track record designing zero‑trust, hardware‑backed IAM at scale for high‑value targets.
• Hands‑on experience securing IAM across AWS, GCP and containerized/Kubernetes environments.
• Ability to balance strong security guarantees with developer‑friendly usability.

Required skills

• Okta, OIDC/OAuth 2.0, SAML, WebAuthn/FIDO2, PKI.
• Cloudflare Access, Tailscale, WireGuard.
• YubiKey, hardware‑backed authentication.
• Teleport, HashiCorp Boundary.
• SPIFFE/SPIRE, Kubernetes service accounts.
• OPA/Rego, Cedar, Terraform, Pulumi.
• Programming: Go, Python, Rust.
• Cloud platforms: AWS, GCP, OCI.