Senior Identity Security Engineer

Location: ES - Spain Scopely is looking for a Senior Identity Security Engineer to join our Information Security team on a remote basis or hybrid basis if located in Barcelona.  This is a hands-on engineer who will build identity controls that reduce excessive privilege and protect critical operations. You will improve access across employee, player, business partner, and non-human identities by building AI-native identity workflows: agentic systems that handle provisioning, access reviews, and remediation within explicit guardrails, with humans approving what matters. Your work will protect the identities and access that support Scopely’s critical business processes, including essential enterprise functions and game operations.  This is a highly technical, hands-on role for someone who can operate across AWS, GCP, Okta, AWS IAM Identity Center, Zero Trust access models, identity governance workflows, and modern AI-enabled engineering environments, while building scalable identity systems through Infrastructure as Code, workflow orchestration, and automation-first security engineering. What You Will Do Reduce identity attack surface and privilege Reduce standing and excessive access with least-privilege roles, just-in-time and time-bound elevation, and automated access reviews. Build repeatable identity and access workflows that make onboarding, approvals, role changes, reviews, and offboarding consistent, traceable, and timely. Govern non-human identities, including service accounts, workload identities, CI/CD identities, API credentials, and AI agents and their tool integrations: inventory them, assign owners, replace long-lived secrets with short-lived or federated credentials, and rotate or revoke on a schedule and on signal. Strengthen identity protection and resilience Protect access to critical business processes and systems with phishing-resistant authentication (passkeys/FIDO2), device trust and posture signals, tightly controlled privileged access, and prompt revocation of suspicious sessions or compromised credentials. Threat-model identity platforms, integrations, and access paths to identify exploitable trust relationships, privilege escalation, and credential misuse. Build identity telemetry and response workflows to detect risky sign-ins, privilege changes, credential misuse, and compromised integrations. Design and test break-glass and recovery procedures for identity services and cloud access so teams can regain secure access during an outage or compromise. Extend the same patterns to player and partner identities where security owns the controls: platform identity federation (Apple, Google, Steam, console), account linking and recovery, external and vendor access, and defenses against account takeover and credential stuffing. Build AI-native identity services Build and operate reusable identity controls and services using infrastructure as code, APIs, scripting, and delivery pipelines. Apply code review, testing, drift detection, and audit trails so that every change, whether made by an engineer or an agent, is safe to deploy and easy to investigate. Design and build multi-agent workflows that surface identity risk, run access attestations, and triage and remediate access issues end to end. Engineer the harness those agents run in: scoped tools and permissions, curated context and data access, evals and test cases, orchestration between agents, and observability, so agent behavior is predictable, reviewable, and improvable. Treat agents as identities. Give every agent and MCP integration its own scoped credentials, least-privilege permissions, and bounded data access; validate inputs and outputs; log every action; and require human approval for changes that touch privileged access or production. Work with game and platform stakeholders to adopt shared identity patterns. Measure progress through reduced standing privilege, stale access, and unmanaged identities, and less manual work. Produce audit-ready evidence for access reviews, privileged access, and lifecycle events as a byproduct of the workflows rather than a separate project. What You Bring 5+ years of experience in IAM, or identity-focused cloud/security engineering, including hands-on ownership of production identity controls in complex environments. Strong experience with Okta or a comparable workforce identity platform and AWS/GCP IAM, as well as federation and provisioning protocols such as SAML, OIDC, OAuth, and SCIM. Production experience building, testing, and operating identity services or automation using Terraform or comparable infrastructure as code, Python, Go, or TypeScript., APIs, version control, and CI/CD. Strong knowledge of least privilege, just-in-time privileged access, identity lifecycle and governance, authentication controls, and non-human or workload identity risk. Experience threat-modeling identity architectures, integrations, and access paths, and driving remediation with service owners. Hands-on experience building AI-native workflows: systems where agents carry out multi-step work end to end, designed from the start around what agents can be trusted to do and where humans approve. Using a coding assistant does not count. Working fluency with harness engineering and multi-agent development: defining tools and permissions, scoping context and data, writing evals, orchestrating specialized agents, and instrumenting agent runs so failures are diagnosable, plus the judgment to keep those systems inside least-privilege boundaries. Ability to lead technical work from design through deployment and operations, and explain identity risks and implementation choices to stakeholders. Experience with identity governance, privileged access, or cloud entitlement tooling, or having built the equivalent in-house. Nice-to-have Consumer identity (CIAM) at scale, Kubernetes workload identity, detection engineering or SIEM experience, Okta or cloud security certifications, gaming or live-service experience. About Scopely Scopely is a leading video game and global interactive entertainment company, home to many of the world’s most beloved and enduring experiences, including two of the most successful mobile games of all-time “MONOPOLY GO!” and “Pokémon GO,” along with “Stumble Guys,” “Star Trek™ Fleet Command,” “MARVEL Strike Force,” “WWE Champions,” the Scrabble® franchise, “Yahtzee® With Buddies,” and many others. Across mobile, web, PC, and console, Scopely creates, develops, publishes, and live-operates one of the most diversified and award-winning portfolios in the games industry — bringing hundreds of millions of players together through a shared love of play. Founded in 2011, Scopely is powered by its exceptional team — including thousands of world-class gamemakers around the globe, a distinctive tenet-driven culture, and its proprietary technology platform, Playgami. Together, these strengths have fueled Scopely’s position as the #1 mobile games company in the U.S. and #2 globally, generating more than $10 billion in lifetime revenue. Whether building global sensations like “MONOPOLY GO!” from the ground up, or expanding through strategic acquisitions, including the FoxNext, GSN, and Scopely Explore games businesses — Scopely consistently delivers experiences players love today and return to for years to come. Recognized multiple times as one of the "100 Most Influential Companies in the World" by TIME magazine and one of Fast Company's "World's Most Innovative Companies" and “Best Workplaces for Innovators,” Scopely believes that video games can be a force for good — creating meaningful connections, vibrant communities, and making life better through play. Scopely has global operations and partners across four continents in more than a dozen countries worldwide. For more information, visit: https://www.scopely.com/ . Notice to Candidates: Scopely will never request payment or financial information during the application or hiring process. Please apply only through our official website and verify that all Talent Partner communications come from an email address ending in @ scopely.com . Should you have any questions or encounter any fraudulent requests/emails/websites, please immediately contact recruiting@scopely.com. Our job applicant privacy policies are available here: California Privacy Notice and EEA/UK Privacy Notice . Employment at Scopely is based solely on a person's merit and qualifications. Scopely does not discriminate against any employee or applicant because of race, creed, color, religion, gender, sexual orientation, gender identity/expression, national origin, disability, age, genetic information, veteran status, marital status, pregnancy or related condition (including breastfeeding), or any other basis protected by law. We also consider qualified applicants with arrest or conviction records, consistent with applicable federal, state and local law.