[Hiring] Security Engineer II @Marqeta

Role Description

We’re seeking an experienced Security Engineer II with a strong passion for Identity and Access Management (IAM) and expertise in cloud-native environments, particularly AWS. You'll build, automate and operate our identity security platforms, help shape modern identity solutions, and reduce standing access and manual work across Marqeta's systems and services, which are 100% cloud-based with no data center footprint.

We work Flexible First. This role can be performed remotely anywhere within Ontario or British Columbia, Canada. We’d love for you to join us!

Join us in building a secure, scalable, and frictionless IAM program where you’ll play a crucial part in:

• Building our Identity Governance and Administration (IGA) capabilities.
• Implementing & Operating Privileged Access Management (PAM) in a cloud-first (AWS-focused) environment.
• Driving integration of IAM across AWS services, SaaS platforms, and developer/DevOps pipelines.
• Designing identity and access controls to protect AI/ML systems—ensuring secure access to training data, models, and inference APIs.

The Impact You’ll Have:

• Configure and maintain Okta SSO, MFA, lifecycle management and policies, including SAML/OIDC app integrations and SCIM provisioning.
• Manage just-in-time access profiles and policies in PAM platforms (such as Britive or CyberArk) for cloud and privileged resources, working with engineering teams to reduce standing privileges.
• Build and improve access request, approval and review workflows in IGA platforms (such as Lumos or SailPoint) to support least privilege and audit readiness.
• Automate joiner, mover and leaver processes and access reviews using scripting, APIs and infrastructure-as-code.
• Partner with Security, DevOps and Infrastructure teams to onboard applications and cloud accounts and to troubleshoot access issues.
• Support SOC 2, PCI DSS and other audit activities by producing access evidence and improving control design.
• Document processes, contribute to team runbooks, and take part in on-call rotation, if applicable.

Qualifications

• A minimum of 3 years related experience with a Bachelor’s degree; or 2 years and a Master’s degree; or equivalent combination of related education and work experience.
• Hands-on experience with IAM tools (e.g., Okta, Entra ID, CyberArk, Ping, SailPoint).
• Working knowledge of SAML, OAuth2/OIDC and SCIM.
• Working knowledge of AWS IAM concepts (roles, policies, federation), plus an understanding of least privilege and RBAC.
• Hands-on scripting skills (e.g., Python, PowerShell) to automate IAM operations through APIs.
• Familiarity with directory services such as Active Directory, LDAP, and cloud-based alternatives.
• Familiarity with compliance frameworks such as NIST, SOC 2 and PCI DSS.
• Clear communication skills and the ability to collaborate with engineers and non-technical stakeholders.

Requirements

• Relevant certifications or IAM-specific credentials (e.g., CIAM/CAMS, CyberArk Certified, Okta Certified Consultant).
• Experience with AWS technologies such as Lambda, S3, DynamoDB, RDS, Aurora, SNS, SQS, CloudTrail, CloudWatch, Code Pipeline, AWS Developer Tools, and IAM roles and permissions.
• Experience with DevOps tools and practices, including secrets management and CICD pipelines.

Benefits

• Multiple health insurance options.
• Flexible vacation time with additional floating holidays.
• Retirement savings program with company contribution.
• Equity in a publicly-traded company.
• Monthly stipend to support our remote work model.
• Annual development stipend to support our people growth and development.
• Family-forming benefits and generous parental leave base salary top-up.