Staff Engineer - Identity and Access Management

This senior individual contributor role serves as the principal technical authority and domain architect for the identity services powering On's global ecosystem, spanning workforce, partners, digital consumers, and cloud workloads. The role owns the technical roadmap for corporate and consumer identity, leads complex enterprise-wide security initiatives, makes critical architectural trade-offs, and cultivates technical excellence across engineering and product teams without direct people management responsibilities. It sits within the Cybersecurity function in On's Technology organisation, protecting the human and non-human identities behind the workplace, cloud platforms, digital supply chain, and athlete/consumer experiences.

• Serve as the principal technical authority and domain architect for identity services spanning workforce, partners, digital consumers, and cloud workloads.
• Own the technical roadmap for corporate and consumer identity.
• Lead large-scale, high-impact IAM engineering and architecture initiatives end-to-end across On's global platforms, ensuring identity solutions deliver robust security, operational resilience, and seamless user experience.
• Make critical architectural trade-offs and lead complex enterprise-wide security initiatives.
• Engage with diverse viewpoints across Cybersecurity, Platform Engineering, Cloud Infrastructure, Product, Privacy, Legal, and Business Operations to forge technical alignment on complex, multi-faceted access problems.
• Anticipate technical, organisational, or operational friction in identity lifecycles and architectures, balancing security controls against velocity, developer experience, and system usability.
• Share knowledge, establish best practices, mentor engineers and security teams, and elevate On's collective identity security maturity through open collaboration.
• Challenge conventions and the status quo to eliminate technical debt and operational toil, championing modern automation, Infrastructure as Code (IaC), and Zero Trust paradigms.
• Cultivate technical excellence across engineering and product teams.

• Extensive, hands-on experience designing, scaling, and operating mission-critical workforce and consumer identity architectures at a global scale.
• Holistic perspective on software engineering, cloud environments (GCP, AWS, Azure), modern DevOps pipelines, and API security, understanding how identity serves as the foundation across all layers.
• Deep expertise in modern authentication, authorization, and federation mechanisms (OAuth 2.0, OpenID Connect, SAML 2.0, SCIM 2.0, WebAuthn/Passkeys, and PAM patterns).
• Courage and straightforward candor to tackle difficult technical challenges, challenge legacy assumptions, and surface risks early, viewing technical disagreements as productive opportunities to reach better architectural outcomes.
• Relational intelligence and synthesis to build strong, authentic relationships with technical and non-technical partners across various domains, translating intricate identity risks into practical, business-relevant solutions.
• Grit and composure under pressure to remain calm, focused, and solution-oriented during high-pressure incidents or complex enterprise migrations, consistently seeing commitments through to delivery.
• Established technical leadership with deep engineering craft, cross-functional collaboration, and strategic systems architecture.

• Environment centred around growth and progress.
• Tools to develop holistically.
• Opportunities to stay active, learn, explore, and innovate.
• Supportive, team-oriented atmosphere.
• Access to personal self-care for both physical and mental well-being.
• Culture led by purpose.