Principal IAM Engineer

Job Description

About the role

We are looking for a principal individual contributor in IT Engineering to build and advance our Identity and Access Management (IAM) function for human and agent identities. You will personally deliver complex engineering work, coach the team and align technical and business partners on a shared identity vision and roadmap.

This role combines engineering, architecture and business systems analysis. Strong communication and stakeholder management are essential. You will turn ambiguous business needs into clear requirements and practical designs, explain trade-offs, and help teams agree on decisions when standards or priorities conflict.

What you will do

• Engineering: Design, build, test and operate complex IAM solutions across identity lifecycle automation, authentication, provisioning, integrations and access governance. Apply SAML, OpenID Connect, OAuth 2.0 and SCIM appropriately, and validate edge cases and recovery before and after changes.
• Automation: Build maintainable automation with APIs and scripting, using version control, peer review and automated tests. Use infrastructure as code where appropriate to make identity configuration repeatable and reviewable.
• Function Building: Build the IAM function by establishing service ownership, engineering standards, operating practices and a prioritized roadmap. Create reusable architecture and integration patterns, support their adoption and measure service reliability and business outcomes.
• Architecture: Define target and reference architectures for identity services, system integrations and authorization models. Document design decisions and assumptions, evaluate build-versus-buy options, and balance security risk, cost, scalability and reliability. Turn architectural direction into sequenced implementation and migration plans. Review proposed designs with engineering, Security and application owners, identifying integration boundaries, failure modes and dependencies before implementation.
• Identity Strategy: Develop a shared direction for human and non-human identities, including service, workload and agent identities. Address ownership, authentication, authorization, scoped delegation, identity and credential lifecycles, revocation and auditability. Work with business and technical partners to agree priorities and sequence delivery.
• Governance: Partner with Security and business owners to define least-privilege access, roles and entitlements. Support access reviews, remediation and audit evidence that demonstrate how access is approved, changed and removed.
• Reliability: Improve identity service monitoring and troubleshoot incidents through root-cause analysis. Maintain runbooks and tested rollback and recovery procedures, and turn operational findings into engineering improvements.
• Discovery: Lead discovery workshops with business and technical stakeholders. Map current and future processes, identify exceptions and dependencies, and reconcile competing needs. Translate business outcomes into functional and non-functional requirements, keeping them traceable through architecture, delivery and testable acceptance criteria.
• Acceptance Testing: Partner with users on user acceptance testing, validate that solutions meet agreed outcomes and resolve gaps before release. Explain technical constraints in business terms, make trade-offs explicit and incorporate feedback into process and service improvements.
• Coaching: Coach engineers and business systems analysts through pairing, design reviews and reusable guidance. Help others take on more complex work independently and reduce reliance on individual experts.
• Conflict Resolution: Resolve cross-team disagreements constructively. Assess proposals against IAM standards and business outcomes, explain risks and trade-offs, and negotiate viable alternatives. Document exceptions and escalate to agreed decision owners when needed.

What you bring

• Delivery: Demonstrated hands-on delivery of complex IAM solutions, with the ability to explain your implementation decisions, testing, operational results and recovery approach.
• Technical Depth: Technical depth in identity lifecycle, authentication, authorization, provisioning and access governance, including SAML, OpenID Connect, OAuth 2.0 and SCIM. Sound judgment in applying least privilege and managing human, service, workload and agent identities.
• Architecture: Experience shaping and delivering architecture across interconnected identity platforms and business systems. You can explain how reference patterns, authorization models and documented decisions guided implementation, and how you assessed security, cost, scalability, reliability and migration trade-offs.
• Automation: Practical experience with APIs, scripting and tested automation, plus the ability to diagnose identity integration failures and translate operational findings into lasting improvements.
• Business Analysis: Strong business systems analysis experience, including discovery and facilitation, current-state and future-state process analysis, requirements reconciliation and business-to-technical translation. You have defined measurable outcomes, maintained requirements traceability and supported acceptance testing with business partners. You can use process maps and user stories to make complex workflows understandable and actionable.
• Communication: Excellent communication and stakeholder management. You listen actively, facilitate discussions, adapt your message to the audience, manage expectations and confirm shared understanding and commitments.
• Coaching: Experience building technical capability through coaching and design review, and establishing standards, ownership and operating practices that others can sustain.
• Influence: The ability to influence across teams, work through competing priorities and reach defensible decisions while maintaining productive relationships.

How you will work

You will partner with the IAM Engineer and IAM Business Systems Analyst, as well as Security, HRIS, application owners, service desk and business stakeholders. You will contribute directly to engineering and business analysis while agreeing responsibilities and decision paths with those partners. This is an individual-contributor role with leadership through expertise, coaching and influence; it does not assume direct reports.

The US annualized base salary range for this position is $193,000.00-$289,000.00. This position may also be eligible for bonus, benefits, or related incentives. While this range reflects the minimum and maximum value for new hire salaries for the position across all US locations, the offer for the successful candidate for this position will be based on job related capabilities, applicable experience, and other factors such as work location. Please note that the compensation details listed in US role postings reflect the base salary only (or OTE for commissions based roles), and do not include bonus, benefits, or related incentives.

The intelligent heart of customer experience

Zendesk software was built to bring a sense of calm to the chaotic world of customer service. Today we power billions of conversations with brands you know and love.

Zendesk believes in offering our people a fulfilling and inclusive experience. Our hybrid way of working, enables us to purposefully come together in person, at one of our many Zendesk offices around the world, to connect, collaborate and learn whilst also giving our people the flexibility to work remotely for part of the week.

As part of our commitment to fairness and transparency, we inform all applicants that artificial intelligence (AI) or automated decision systems may be used to screen or evaluate applications for this position, in accordance with Company guidelines and applicable law.

Zendesk is an equal opportunity employer, and we’re proud of our ongoing efforts to foster global diversity, equity, & inclusion in the workplace. Individuals seeking employment and employees at Zendesk are considered without regard to race, color, religion, national origin, age, sex, gender, gender identity, gender expression, sexual orientation, marital status, medical condition, ancestry, disability, military or veteran status, or any other characteristic protected by applicable law. We are an AA/EEO/Veterans/Disabled employer. If you are based in the United States and would like more information about your EEO rights under the law, please click here.

Zendesk endeavors to make reasonable accommodations for applicants with disabilities and disabled veterans pursuant to applicable federal and state law. If you are an individual with a disability and require a reasonable accommodation to submit this application, complete any pre-employment testing, or otherwise participate in the employee selection process, please send an e-mail to [email protected] with your specific accommodation request.