<h3><strong>About the Company</strong></h3> <p>We are a renewable energy and ocean technology company committed to rapidly developing and deploying technologies that will ensure a sustainable future for Earth by unlocking the vast energy potential of its oceans. Our focus is on capturing civilizational levels of ultra-low-cost renewable energy for applications including computing and affordable renewable fuels delivered to shore.</p> <p>The company is a public benefit corporation headquartered in Portland, Oregon, and backed by leading venture capitalists, philanthropic investors, university endowments, and private investment offices. We operate as an idea meritocracy in which the best ideas change the company’s direction on a regular basis.</p> <p>Our staff have worked at organizations such as SpaceX, Blue Origin, Boeing, Tesla, Apple, Virgin Orbit, Astra, Google, Amazon, Microsoft, New Relic, Bridgewater, Raytheon, Disney Imagineering, and the US Army and Air Force, as well as research universities, startups, and small companies across a range of industries.</p> <h3><strong>About the Job</strong></h3> <p>Our core technology is the node, a device that produces energy in the ocean’s harshest conditions for years at a time without human maintenance or intervention.</p> <p>We're looking for an IAM Engineer to own the identity plane at Panthalassa. Identity is the control point for everything we do: who gets access to what, on which device, from where, and for how long. You'll build that system and the automation behind it.</p> <p>This is a high-ownership individual contributor role. You'll administer Microsoft Entra ID and Google Workspace identity, design Conditional Access and context-aware policy, automate joiner/mover/leaver, and bring every SaaS application in our stack under SSO and automated provisioning. You'll also help govern the identities that aren't people: service accounts, OAuth grants, and workload credentials. We have an established zero trust roadmap and a security framework to comply with, and your job is to turn both into enforceable technical controls and explain the reasoning well enough that the rest of the company comes along with you.</p> <p>Candidates should have strong interpersonal skills and be able to thrive in a creative, scrappy, and collaborative environment in which the best ideas change the company’s direction on a regular basis.</p> <h3><strong>Responsibilities</strong></h3> <h4><strong>Identity Infrastructure</strong></h4> <ul> <li>Administer Microsoft Entra ID, including user lifecycle, group management, dynamic membership rules, and role assignment.</li> <li>Design and maintain Conditional Access policy, tying device compliance posture, identity signals, risk, and location to resource access.</li> <li>Own authentication standards: MFA, phishing-resistant methods, passwordless rollout, and legacy auth retirement.</li> <li>Partner with our Endpoint Engineer so access policy and device posture stay in sync.</li> </ul> <h4><strong>Access Automation and Lifecycle</strong></h4> <ul> <li>Automate joiner, mover, and leaver so access is granted and revoked from a source of truth rather than a ticket.</li> <li>Manage SSO integrations and application provisioning via SAML and SCIM across our SaaS stack.</li> <li>Build and run access review and recertification cycles that produce evidence auditors accept.</li> <li>Implement least privilege for privileged roles, including just-in-time elevation and break-glass procedures.</li> </ul> <h4><strong>Non-Human Identity and Governance</strong></h4> <ul> <li>Govern service accounts, OAuth grants, and API credentials: naming conventions, ownership, scope review, and rotation.</li> <li>Establish where secrets live and how they are issued, stored, and retired.</li> <li>Maintain a defensible inventory of who and what can reach our systems.</li> </ul> <h4><strong>Security and Compliance</strong></h4> <ul> <li>Advance our zero trust roadmap and translate policy into enforceable technical controls.</li> <li>Own the access control domain of our compliance framework (NIST or equivalent), including documentation and evidence.</li> <li>Partner with information security leadership on access control policy, identity threat detection, and incident response involving compromised accounts.</li> </ul> <h3><strong>Required Qualifications</strong></h3> <ul> <li>Experience administering identity and access in a modern IdP, including user lifecycle, groups, and conditional or context-aware access.</li> <li>Experience implementing SSO and provisioning integrations (SAML, SCIM) across a SaaS stack.</li> <li>Automation experience: scripting or API work against identity and SaaS platforms rather than console-only administration.</li> <li>Ability to write clear documentation and turn written policy into enforceable technical controls.</li> <li>Ability to explain the reasoning behind an access decision to a non-technical audience and get buy-in.</li> </ul> <h3><strong>Desired Qualifications</strong></h3> <ul> <li>Experience owning an IdP at a growing technology company.</li> <li>Familiarity with zero trust architecture and how it translates into identity controls.</li> <li>Experience with identity governance and administration: access reviews, entitlement management, and privileged access.</li> <li>Experience governing non-h