IAM Engineer

An Introduction to Primer Primer is the unified infrastructure for global payments. We give finance and payments teams the visibility and control to reduce complexity, improve performance, and capture more revenue - all from a single platform. Backed by Sofina, Peak XV Partners, ICONIQ, Tencent, Accel, and Balderton, we're building the payments layer the world's best companies rely on. Watch our showcase > https://primer.io/the-primer-showcase Read up on our $100m Series C https://www.primer.io/blog/series-c Learn more about our culture > https://primer.io/careers Which team will you be joining? You're joining the Security team at a critical inflection point. We're standing up dedicated IAM alongside GRC and Workplace Technology, and this role is the connective tissue that makes all three effective. Every new joiner, internal move, and leaver flows through IAM provisioning. You'll own the day-to-day queue, but you're not just firefighting. You'll be building the automation that shrinks that queue: SCIM-based day-one provisioning, deprovisioning pipelines, access review automation. This is where the long-term leverage lives. You'll report to the Head of Security and partner closely with the GRC and Workplace Technology teams. Unlike many security roles that sit in isolation, this one is partnership-driven. You'll work with people, engineering, workplace technology, compliance, and the wider infrastructure team to make provisioning and access governance actually work at scale. What will you be doing? - Stabilise and own the IAM request queue as the company scales. You'll inherit an active backlog, understand which requests are genuinely urgent and which are nice-to-have, and establish a baseline for time-to-resolution that holds steady as the company grows. - Build and maintain SCIM auto-provisioning flows for day-one account setup across our SaaS tools (Okta, Slack, GitHub, etc.). This is the highest-leverage workload reduction project. You'll own the end-to-end flow from requirements through implementation and troubleshooting. - Design and execute the IAM enrolment improvements roadmap, including finalising Mac/Windows enrolment, progressing the Okta rollout, and building the fallback workflows in Tines. You'll work with engineering and infrastructure teams to understand technical dependencies and ship these initiatives on time. - Partner with GRC to run automated access reviews and certification campaigns. You'll design the review workflows, maintain the data pipelines, and work toward measurable reduction in standing access and access sprawl. - Progress IAM-related technical debt and risk. You'll own JIT/PAM initiatives, least-privilege evidence collection for audits, and the automation roadmap that underpins context-aware access. - Remove identity and provisioning load from Workplace Technology, freeing that team to focus on IT support, device management, and people systems. What we're looking for - You've shipped identity or access management systems in production before—whether at a fintech, security-focused company, or infrastructure-heavy environment. You understand Okta (or similar IDPs), SCIM provisioning, access review workflows, and the real-world friction of scaling identity at a growing company. - You're equally comfortable building automation (Python, Go, or similar) and integrating tools like Tines, Okta, and cloud IAM services. You don't need to be a security expert, but you need to understand the why behind least-privilege, deprovisioning, and audit trails. - You have strong operational ownership. You'll inherit a backlog and make the call on what's urgent, what can wait, and what needs engineering help. You own the queue, not the other way around. - You can learn Primer's specific stack and people-systems on the job. What matters is your ability to reason through access problems and translate business requirements into working systems. - You collaborate well with non-eng