Note: The job is a remote job and is open to candidates in USA. Webflow is hiring a Lead Platform Engineer, Identity & Access to own the architecture and roadmap for workforce identity, with Okta as its core platform. The role focuses on governing and automating identity and access, building scalable application onboarding, and partnering with Security to strengthen access controls and respond to identity incidents.
Responsibilities
- Own the identity architecture and roadmap for workforce identity, with Okta as the core platform, including build versus buy decisions
- Bring our Okta tenant under proper management, with configuration standards, hardening, change control, and configuration as code (Terraform, APIs, Okta Workflows, or scripts where the platform falls short)
- Automate the identity lifecycle from joiner to leaver, using our HRIS as the source of truth and SCIM to downstream applications
- Build paved roads for application onboarding, including standard SSO patterns, provisioning templates, and federated access to our cloud and source control platforms, so app owners can integrate without platform team involvement
- Design the access model: role based access control (RBAC), least privilege, request and approval workflows, and access reviews, with tooling that answers “who has access to what, and why” and produces audit evidence automatically
- Strengthen how access is granted through phishing resistant MFA, device trust and risk signals, and governed non human identities (service accounts, tokens, OAuth grants, and AI tools and agents), and stream identity telemetry to Security for detection and response
- Serve as the top escalation point and primary responder for identity incidents and outages should they arise, including on call coverage for critical identity services, post incident reviews, and log analysis with Security
- Manage the Okta vendor relationship, licensing, and cost
Skills
- Minimum of 8 years in identity, platform, or infrastructure engineering, including ownership of a workforce identity platform at meaningful scale
- Fluency in SAML, OIDC, OAuth 2.0, and SCIM, including debugging at the token and assertion level
- Experience with identity governance, including RBAC design, HRIS driven lifecycle automation, and meeting audit requirements
- Strong grounding in Zero Trust and identity based attacks, including device trust and the security of non human identities
- Scripting ability (Python, JavaScript, or similar) and infrastructure as code experience, such as Terraform
- Clear communication with senior and executive audiences, including driving architecture decisions
- Deep hands on experience architecting an enterprise identity provider, with Okta strongly preferred
- Experience governing identities for AI tools and agents, and Okta certifications
Benefits
- Remote-first (United States)
- Every permanent Webflower receives equity (RSUs) in our growing, privately held company.
- Comprehensive medical, dental, and vision plans for full-time employees and their dependents, with Webflow covering most premiums.
- 12 weeks of paid parental leave for all parents and 6+ weeks of additional paid leave for birthing parents.
- Inclusive care for family planning, menopause, and midlife transitions.
- Flexible vacation, paid holidays, and a sabbatical program.
- Access to mental health resources, therapy and coaching.
- A 401(k) with 100% employer match (up to $6,000/year) in the U.S., and support for retirement savings globally.
- Monthly localized support for work and wellness expenses — from Wi-Fi to workouts.
- All full-time, permanent, non-commission employees are eligible for our annual WIN bonus program.
- Temporary employees may be eligible for paid holiday and time off, statutory leaves of absence, and company-sponsored medical benefits depending on their Fixed Term Contract and their country/state of employment.
Company Overview