Senior Identity Security Engineer

About the role

Scopely is looking for a Senior Identity Security Engineer to join our Information Security team on a remote basis or hybrid basis if located in Barcelona. This is a hands-on engineer who will build identity controls that reduce excessive privilege and protect critical operations. You will improve access across employee, player, business partner, and non-human identities by building AI-native identity workflows: agentic systems that handle provisioning, access reviews, and remediation within explicit guardrails, with humans approving what matters. Your work will protect the identities and access that support Scopely’s critical business processes, including essential enterprise functions and game operations. This is a highly technical, hands-on role for someone who can operate across AWS, GCP, Okta, AWS IAM Identity Center, Zero Trust access models, identity governance workflows, and modern AI-enabled engineering environments, while building scalable identity systems through Infrastructure as Code, workflow orchestration, and automation-first security engineering.

What You Will Do

Reduce identity attack surface and privilege

- Reduce standing and excessive access with least-privilege roles, just-in-time and time-bound elevation, and automated access reviews.

- Build repeatable identity and access workflows that make onboarding, approvals, role changes, reviews, and offboarding consistent, traceable, and timely.

- Govern non-human identities, including service accounts, workload identities, CI/CD identities, API credentials, and AI agents and their tool integrations: inventory them, assign owners, replace long-lived secrets with short-lived or federated credentials, and rotate or revoke on a schedule and on signal.

Strengthen identity protection and resilience

- Protect access to critical business processes and systems with phishing-resistant authentication (passkeys/FIDO2), device trust and posture signals, tightly controlled privileged access, and prompt revocation of suspicious sessions or compromised credentials.

- Threat-model identity platforms, integrations, and access paths to identify exploitable trust relationships, privilege escalation, and credential misuse.

- Build identity telemetry and response workflows to detect risky sign-ins, privilege changes, credential misuse, and compromised integrations.

- Design and test break-glass and recovery procedures for identity services and cloud access so teams can regain secure access during an outage or compromise.

- Extend the same patterns to player and partner identities where security owns the controls: platform identity federation (Apple, Google, Steam, console), account linking and recovery, external and vendor access, and defenses against account takeover and credential stuffing.

Build AI-native identity services

- Build and operate reusable identity controls and services using infrastructure as code, APIs, scripting, and delivery pipelines. Apply code review, testing, drift detection, and audit trails so that every change, whether made by an engineer or an agent, is safe to deploy and easy to investigate.