[Hiring] Security Architect @Grainger Businesses

Role Description

The Information Security team protects all of Grainger, from our systems to our data across the global company. Our infrastructure is powered by cloud, on-premises, and SaaS platforms that keep Grainger, and our customers, working. We use modern tools and practices to stay ahead of evolving security challenges.

The mission of the Security Architecture team is to be the strategic security design partner for Grainger’s technology systems. As the security architect responsible for Grainger’s identity ecosystem, you will be responsible for:

• Architecting, advising on, and governing how every human, machine, workload, and AI agent authenticates and is authorized across our environments.
• Owning the architecture spanning workforce identity, customer identity, privileged access, non-human and machine identity, secrets, and certificate lifecycle management.
• Supporting the progressive needs of the business and providing timely, secure, and cost-efficient solutions that elevate the company’s identity security strategy.
• Setting multi-year identity strategy and reference architecture.
• Rationalizing a broad and overlapping portfolio of identity technologies into a defensible target state.
• Translating business context into identity requirements and identity risk into business impact.

This individual contributor role reports to the Director of Cybersecurity Architecture and may be based remotely or at our offices in the Chicago area.

Qualifications

• Deep expertise designing enterprise identity architectures for large, complex organizations.
• 10+ years in information security or identity engineering, including 8+ years in security architecture with at least 6 years focused on identity.
• Bachelor’s degree preferred; equivalent professional experience accepted.
• Preferred certifications: CISSP, CCSP, SABSA, IDPro CIDPRO, or vendor identity certifications.
• Proven ability to align senior technology and business stakeholders behind multi-year identity direction amid competing priorities.

Requirements

• Experience rationalizing overlapping identity portfolios: capability mapping, build/buy/consolidate analysis, and migration strategy.
• Expert understanding of OAuth 2.0/2.1, OIDC, SAML, SCIM, JWT, mTLS, token exchange, PKCE, and FIDO2/WebAuthn.
• Deep experience with workforce and customer identity platforms in hybrid environments (e.g., Okta, Microsoft Entra ID, Auth0, etc.), Active Directory, conditional access, and passwordless authentication.
• Strong cloud identity skills in AWS-primary environments: IAM policy and SCP design, permission boundaries, role assumption, and entitlements at scale.
• Specialized expertise in non-human and machine identity: workload identity, secrets management, certificate lifecycle and PKI.
• Working knowledge of AI and agentic identity: agent authentication patterns, delegated authority, and security frameworks.
• Experience with IGA and PAM platforms: entitlement modeling, access certification, credential vaulting, and just-in-time cloud access.
• Substantive understanding of OT/ICS identity, including shared operator accounts and vendor remote access.
• Familiarity with identity threat detection and response, attack path analysis, and identity enforcement at edge and API layers.
• Strong communication skills, including the ability to translate technical concepts for executives.

Benefits

• Medical, dental, vision, and life insurance plans with coverage starting on day one of employment.
• 6 free sessions each year with a licensed therapist to support your emotional wellbeing.
• 18 paid time off (PTO) days annually for full-time employees and 6 company holidays per year.
• 6% company contribution to a 401(k) Retirement Savings Plan each pay period, no employee contribution required.
• Employee discounts, tuition reimbursement, student loan refinancing, and free access to financial counseling.
• Maternity support programs, nursing benefits, and up to 14 weeks paid leave for birth parents and up to 4 weeks paid leave for non-birth parents.