Senior Software Engineer 2, IAM

About this role

Our Mission & Values: At Drata, we help companies earn and keep the trust of their users, customers, partners, and prospects. We’re the proof layer that shows great companies deserve the trust they aim to build. We live our values every day. Built on Trust means consistency is everything. Act with Integrity by always doing the right thing. Being Customer-Obsessed keeps the people we serve at the center of our work. Competitive Fire drives us to push ourselves harder than anyone else. Diversity brings unique perspectives that lead to better solutions. Automation First ensures we save time and money by making efficiency a priority. Our Culture & Work Style 🚀 At Drata, we’re not just building software - we’re building a mindset. Everything we do springs from: - Be a Driver (Owner‑Operator Mentality): Own your work. Improve relentlessly. Deliver results. - Move at Drata Speed (Precision & Velocity): Fast decisions. Quick learning. Immediate impact. - Stay Mission-Driven (Customer‑Obsessed): Challenge assumptions. Deliver value. Stay hungry. We pair that high-velocity culture with a thoughtful hybrid model because we believe flexibility and collaboration both matter. That’s why in the Bay we come together in-office Tuesday through Thursday our high‑impact collaboration days where teams align, strategize, and innovate. Mondays and Fridays are flexible, giving you space for focused work, balance, and autonomy. If you thrive when you’re empowered, energized, and working with smart, mission-driven people, you’ll feel at home here. Why Join The Drata Team? The best way to understand the Driver’s Mindset is to see it in action. We’re an award-winning, mission-driven team of 600+ people worldwide, united by a culture that values trust, speed, and continuous growth. - See the Speed: https://www.youtube.com/watch?v=QidTdkGwKMY Watch our CEO, Adam Markowitz, discuss the hyper-growth journey, from $0 to $100M ARR in just four years - Hear the Voice of the Team https://drata.com/about/life-at-drata: Explore our "Life at Drata" page for employee testimonials on our collaborative and the growth opportunities available. - Experience the Impact https://www.greatplacetowork.com/certified-company/7044563: See why we are consistently recognized on Fortune's Best Workplaces lists. - Connect with Us on Socials: LinkedIn https://www.linkedin.com/company/drata/posts/?feedView=all - follow us for company updates, employee stories, and career news. Job Summary: Drata's Identity & Access Management team owns the identity, authentication, and access control infrastructure that every customer uses to access the platform — and that every internal platform service relies on for trust boundaries. - Authentication — SSO (SAML 2.0, OIDC), session/token management, MFA. We're focused on authentication for enterprise customers — large user populations, sophisticated identity setups, and the uptime and observability that scale demands. - Authorization — the access control model that determines what users, services, and agents can do across the platform — from role-based access to fine-grained authorization for enterprise customers, internal services, and AI-driven actions. - Provisioning & lifecycle — SCIM 2.0 provisioning for enterprise customers like Okta, Microsoft Entra ID, and others. Group-to-role mapping, conflict resolution, and the long tail of behaviors enterprise identity setups demand. - Identity sync infrastructure — keeping Drata's view of the customer's workforce accurate via against Okta, M365, Google, and beyond. Efficiency across provider support, customers with small to enterprise user populations and to surface what's happening clearly when something goes wrong. - Auth for platform services and AI — providing the trust primitives other Drata services build on, and supporting authentication and human-in-the-loop authorization patterns for AI features and agentic workflows. What you'll do: - Design and operate Drata's authentication surface: SSO integrations (SAML, OIDC), session and token handling, MFA, and flexible enterprise identity configurations. - Contribute to Drata's authorization architecture — collaborating on direction, owning meaningful pieces of execution, and bringing your perspective on the tradeoffs (RBAC vs. ABAC vs. etc., policy engines, audit and observability of access decisions). - Build and harden SCIM provisioning at enterprise scale: group sync, role mapping, deactivation, conflict resolution, and the long tail of IdP-specific behavior. - Build and operate identity sync workflows — full and delta syncs across major identity providers — with the observability, retry semantics, and parity guarantees enterprise sync demands. - Build authentication and authorization for AI features and agentic flows: scoped credentials for AI agents, human-in-the-loop approval workflows, and the audit trail needed to defend AI-driven actions in a compliance product. - Provide the auth primitives other platform services depend on, and represent IAM in cross-team architecture discussions. - Threat-model identity surfaces, partner with security on hardening, and own the response when identity is implicated in an incident. What you'll bring: - 7+ years building production software, with meaningful time spent on authentication, authorization, or identity infrastructure. - 3+ years experience in a NodeJS / TypeScript codebase with a deep understanding of Typescript. - Working knowledge of the identity protocols this team operates against: OAuth 2.0 / OIDC, SAML 2.0, SCIM 2.0. You don't need to have shipped all three — fluent enough to design against them. - Experience designing or operating access control systems — at minimum RBAC, ideally with exposure to attribute-based or relationship-based authorization. - Working knowledge of surfacing observability & security information from complex systems. - Experience designing and collaborating on API desig