This list contains only the countries for which job offers have been published in the selected language (e.g., in the French version, only job offers written in French are displayed, and in the English version, only those in English).
We're looking for an IAM Security Operations Manager to lead Shopify's Worker Identity function within the Security team. You'll lead a team of security analysts and system admins across Shopify's worker identity program — and own the systems, processes, and risk intelligence that ensure the right people have the right access at the right time, and nobody else does.
Job Responsibility:
Own the end-to-end access lifecycle and risk analysis for workers of all types — provisioning, deprovisioning, transfers, access, entitlements, and ongoing risk assessments across Shopify's systems
Own the IAM analysis function — identifying overprivileged and anomalous access, and producing the risk intelligence that informs access decisions across Shopify
Lead, develop, and grow the worker identity team as the work requires, setting clear expectations, removing blockers, and driving high performance through direct feedback
Own operational metrics and use data to drive workflow improvements
Manage IAM tooling operations and drive automation to reduce manual toil
Own and continuously improve the controls, builds, and monitoring that keep Shopify's access environment secure and observable
Build and maintain playbooks, ensuring consistent operations and decision making
Own the worker identity roadmap — defining what the team focuses on and how to mitigate risk
Support an on-call rotation, ensuring IAM operational issues are triaged and resolved quickly
Partner cross-functionally with IT, Security Engineering, Privacy, Legal, Talent, and Compliance to align you team’s work with broader Trust and Shopify objectives.
Requirements:
Experience managing a security or IAM team, with a track record of building high-performing teams and growing headcount as scope expands
Deep understanding of identity lifecycle management across employees and non-employees — RBAC/ABAC models, access governance, and contractor and vendor offboarding
Track record of improving operational metrics and reducing toil — consistent execution with a bias toward fixing what's broken
Hands-on familiarity with IAM tooling (e.g. Okta, Google) and protocols (e.g. SAML, SCIM, OIDC)
Strong, crisp communication across decisions, playbooks, and everything in between.
Nice to have:
Experience in threat detection and third party risk management
Background in compliance frameworks (SOC 2, SOX, ISO 27001) as they relate to access controls
Experience operating IAM at scale in a cloud-native environment (GCP, AWS)
Familiarity with one or more of the following tools: Google, Okta, Fleet, Slack, Freshworks, macOS, Workday, and GitHub.