MTS Lead, Identity and Access Management
Leads architecture, build, and operation of Reflection's zero-trust identity infrastructure: hardware-backed phishing-resistant auth (WebAuthn/Okta), just-in-time credentials for GPU clusters, workload/machine identity (SPIFFE), and policy-as-code, writing custom tooling in Go, Python, or Rust on AWS/GCP.
- Compensation
- Not disclosed
- Location
- San Francisco, United States
- Work setup
- Onsite
- Seniority
- Lead
- Employment
- Not specified
- Experience
- 15+ years
- Category
- Security
- Posted
Skills
Must have
- 15+ years in identity security, security architecture, or infrastructure engineering in high-growth startups, hyperscale clouds, or elite security teams
- Track record architecting and operating zero-trust identity infrastructure at scale (hardware-backed auth, JIT credentialing, workload identity)
- Hands-on securing IAM boundaries across AWS and GCP and containerized environments, incl. Kubernetes identity federation and IAM roles for service accounts
- Experience building and operating privileged access management for large-scale compute, incl. GPU cluster access in cloud/neocloud contexts
- Experience partnering with detection and response teams on identity telemetry and adversary-focused detection logic
- First-principles understanding of OAuth 2.0, OIDC, SAML, WebAuthn/FIDO2, and PKI
- Strong software engineering in Go, Python, or Rust for custom tooling, API integrations, and automation
- Proficiency in Infrastructure as Code (Terraform, Pulumi)
- Working knowledge of identity-targeted adversary techniques (session token theft, OAuth consent abuse, device registration hijacking, Golden SAML)
- Ability to design identity systems balancing rigorous security with developer-friendly operations
Nice to have
- Deeply developer/researcher-obsessed mindset — secure path is the easiest path
- Keeps current with modern open-source, developer-first identity/security tooling over legacy enterprise suites
- Threat-aware resilience: designs assuming components will be compromised
- Builder mentality, energized by creating identity infrastructure from scratch
Full description
Our Mission
Reflection is a research lab making intelligence open and accessible for everyone to use, customize, and build on. We build open models that let anyone control their intelligence and help shape the future of AI. Our mission: make intelligence open and accessible to all.
Role Overview
The Head of Identity and Access Management is responsible for architecting, building, and operating Reflection’s identity infrastructure — the foundational security layer in an environment where the perimeter is entirely identity-based and the threat model includes sophisticated, highly motivated nation-state actors targeting intellectual property, training pipelines, and model weights. This leader will design and operate a bleeding-edge, zero-trust identity architecture that treats identity as software, eliminates static credentials, and protects Reflection’s researchers and massive-scale compute environments without introducing friction.
This is not a traditional enterprise IAM or Active Directory management role. The ideal candidate is a security architect and software engineer in equal measure — capable of mandating hardware-backed phishing-resistant authentication globally, building just-in-time credentialing systems for GPU cluster access, and engineering dynamic, context-aware authorization pipelines that hold up against the most advanced adversary techniques. They bring first-principles cryptographic depth, cloud-native mastery, and the software engineering capability to build custom tooling where commercial solutions fall short.
This is a high-stakes, high-visibility role at the center of Reflection’s security posture. Success requires the ability to build identity infrastructure that is simultaneously state-of-the-art in its security guarantees and genuinely developer-friendly in its design — because at Reflection, security that slows down a researcher is security that has failed.
What You'll DoNext-Generation IAM Architecture
- Design and implement a resilient, cloud-native identity architecture leveraging modern IdPs (Okta, OIDC/OAuth 2.0 federations) unified with edge-enforced zero-trust access networks (Cloudflare Access, Tailscale / WireGuard topologies).
- Architect and continuously evolve the organization’s identity boundary with a first-principles approach — replacing legacy constructs with modern, cryptographically-grounded alternatives at every layer.
- Own the full identity lifecycle architecture across corporate, production, and research environments, ensuring consistency, auditability, and resilience across all access surfaces.
Phishing-Resistant Zero Trust
- Mandate and enforce hardware-backed authentication (YubiKeys/WebAuthn) globally across all corporate, production, and research endpoints.
- Eliminate SMS, TOTP, and legacy MFA bypass vectors — driving the organization to a posture where phishing-resistant authentication is the only path.