THE ROLE

You will be the architect of risk reduction, transforming raw vulnerability data into a prioritized roadmap for a secure enterprise. Your mission is to move beyond "fixing everything" to strategically eliminating the specific vulnerabilities that pose the highest risk to our global infrastructure. By collaborating across Cloud, DevSecOps, and Product teams, you will ensure our security posture is proactive, measurable, and deeply integrated into our delivery lifecycle. This role is a high-impact opportunity to influence how we define "safe" across a modern, multi-cloud environment.

WHAT YOU’LL DO

• Drive Risk-Based Prioritization: Shift the organization from volume-based reporting to intelligence-driven action by correlating vulnerability data with exploitability, asset criticality, and attack surface exposure to ensure teams focus on what matters most.
• Operationalize Global Scanning: Lead the end-to-end operation and continuous improvement of enterprise scanning across AWS, Azure, GCP, and containerized environments to maintain 100% visibility of our digital footprint.
• Enable Cross-Functional Remediation: Partner directly with Infrastructure and Engineering owners to drive remediation efforts against established SLAs, identifying root causes like base-image drift or patching gaps to prevent recurring risks.
• Integrate Defense Context: Collaborate with Detection and Incident Response teams to map vulnerability classes to active threats, helping determine if known exposures contributed to incidents and identifying where new detections are required.
• Engineer Operational Excellence: Automate the lifecycle of a vulnerability—from discovery and Jira ticket creation to final reporting—providing leadership with "Fix Impact Reports" that clearly quantify how our security efforts reduce business risk.

WHAT YOU BRING

The Core Essentials

• 5+ years of experience in security operations, vulnerability management, or security engineering in an enterprise environment (or equivalent practical experience).
• Hands-on experience running vulnerability management programs and working with asset discovery and/or secrets detection tools (e.g., runZero, TruffleHog, GitLeaks, or similar).
• Experience configuring and operating a Zero Trust / secure web gateway platform (e.g., Zscaler ZIA/ZPA or similar) and securing at least one major cloud provider (AWS, GCP, or Azure).
• Proficiency in SIEM detection engineering (preferably Splunk) and scripting or programming in at least one of: Python, PowerShell, or Bash.
• Demonstrated ability to partner with engineering teams to prioritize and drive remediation, and to explain technical risk in clear, business-relevant language.
• We are primarily an in-office environment and therefore, you will be expected to work from the Prague office in compliance with Pure’s policies, unless you are on PTO, or work travel, or other approved leave.

Bonus Points (Preferred Skills)

• Experience with Zscaler ZIA/ZPA specifically, including SSL inspection design, certificate management, and policy tuning in a global environment.
• Experience integrating secrets scanning into CI/CD pipelines and automating remediation.
• Exposure to threat emulation / adversary simulation (e.g., Atomic Red Team) and deception technologies mapped to MITRE ATT&CK.
• Background in penetration testing, red team, or purple team activities that inform defensive control design.

THE ROLE

…. Do you lie awake at night, thinking of NIST SP800-63-3? Do you get shivers when you hear the words “service account”? Does “zero trust” actually mean something to you? As they say, Identity is the new perimeter, and it could be your new frontier here at Pure Storage.

The Global Information Security Office (GISO) at Pure Storage is seeking an experienced IAM Operations Engineer to operate and continuously improve our enterprise Identity and Access Management services. This role is responsible for ensuring the stability, scalability, and operational effectiveness of IAM platforms while delivering secure, compliant access across on-premises and multi-cloud environments.

In this role, you will own the day-to-day operation of authentication and identity lifecycle services, supporting incident, problem, and change management processes. You will ensure IAM services meet defined SLAs, adhere to security policies, and maintain compliance with regulatory and audit requirements while enabling a seamless end-user experience.

WHAT YOU'LL DO

• Manage IAM service performance by defining, tracking, and analyzing operational KPIs, SLAs, and SLOs to ensure high availability, reliability, and continuous improvement.
• Administer and support enterprise IAM platforms, including:
• Identity Providers (IdP)
• Privileged Access Management (PAM)
• Identity Governance & Administration (IGA)
• Secrets Management and PKI
  (e.g., Okta, Lumos, Okta Privileged Access, 1Password, HashiCorp Vault, Keyfactor, etc.)
• Perform day-to-day IAM operational activities while contributing to the strategic IAM roadmap.
• Provide advanced technical support and serve as an escalation point for IAM-related issues.
• Own the lifecycle management of IAM services, including maintenance, upgrades, backups, monitoring, imaging, and patching.
• Partner with business stakeholders to adapt IAM controls and policies in alignment with evolving business processes while ensuring a seamless end-user experience.
• Develop and maintain documentation, operational procedures, and runbooks to ensure service sustainability and operational readiness.
• Deliver new IAM services and features in support of evolving business and security requirements.
• Oversee access reviews, RBAC implementations, and identity lifecycle management processes to maintain compliance and governance standards.
• Identify and implement automation opportunities to improve efficiency, reduce manual processes, and strengthen security posture.
• Lead problem management efforts by conducting root cause analysis, resolving recurring issues, and improving overall platform reliability and user experience.
• Participate in a scheduled on-call rotation to provide 24/7 support for production systems.
• We are primarily an in-office environment and therefore, you will be expected to work from the Prague office in compliance with Everpure's policies, unless you are on PTO, or work travel, or other approved leave.

WHAT YOU BRING

• 3-5+ years of experience supporting enterprise IAM platforms (Okta, PAM solutions, IGA tools, Vault, PKI systems, etc.).
• Proven ability to define, govern, and report on SLAs, SLOs, OLAs, and KPIs to ensure service performance, reliability, and customer satisfaction.
• Familiarity with leading incident and problem management efforts, conducting root cause analysis (RCA), and implementing corrective and preventive actions to strengthen service resilience.
• Experience participating in structured change governance processes, risk assessment, and release oversight.
• Hands-on experience with observability, logging, and monitoring tools (e.g., Splunk, Prometheus, Datadog, etc.).
• Strong understanding of identity lifecycle management, RBAC, and access governance principles.
• Nice to have experience in Infrastructure as Code and automated configuration management using tools like Terraform and/or Ansible.
• Technical experience with scripting and automation (e.g., Python, PowerShell, Bash, Tines) to improve operational efficiency and streamline IAM services.
• Experience driving service reviews, performance reporting, and stakeholder communications across technical and business audiences.
• Strong documentation and governance experience, including maintaining service catalogs, service charters, SOPs, and operational runbooks.

#LI-ONSITE

At JetBrains, code is our passion. Since 2000, we’ve focused on helping developers work faster by automating routine checks and fixes.  Our tools are used by over 12.5 million people worldwide, including eighty-eight Fortune Global 100 companies.

We are seeking a detail-oriented IAM Security Specialist to lead the integration, support, and governance of our identity ecosystem. You will be the bridge between technical implementation and security compliance, ensuring that every identity, whether human or machine, has exactly the permissions it needs and nothing more. Your focus will be on building scalable RBAC models and maintaining a rigorous access review cycle.

Key responsibilities

System integration and support:

• Lead the technical integration of new applications and services into our centralized IAM platform.
• Provide expert support for complex authentication/authorization issues and serve as a technical escalation point.
• Maintain and optimize IAM infrastructure, including SSO (SAML, OAuth 2.0, OIDC), MFA, and PAM solutions.

Access governance and permission reviews:

• Execute and oversee periodic access re-certifications, ensuring compliance across periodic audit cycles (SOC 2).
• Conduct detailed permission reviews for individuals and system integrations to enforce the Principle of Least Privilege (PoLP).

RBAC and ABAC modeling:

• Design, document, and implement Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) frameworks across a wide range of systems.
• Partner with cross-functional teams (IT, Product, HR) to define business roles and translate them into technical entitlements.

Required skills and experience

• 3+ years of professional experience focused on Identity and Access Management (IAM) engineering or architecture.
• Proven experience administering enterprise IAM solutions and integrating them with diverse systems (e.g., Okta, Auth0, Ping Identity, Microsoft Entra ID).
• Scripting and automation skills using a scripting language such as Python, Go, Bash, or PowerShell.
• Familiarity with cloud IAM solutions (e.g., AWS IAM, GCP IAM).
• Solid understanding of networking, security protocols, and SSO technologies and standards, including SAML, OAuth 2.0, and OIDC.

Preferred qualifications

• Experience in the software development industry, particularly with managing access to source code repositories (Git/GitHub/GitLab) and CI/CD tools (TeamCity, GitLab CI).
• Hands-on experience with Privileged Access Management (PAM) concepts and tools.
• Knowledge of Zero Trust Architecture (ZTA) principles and how to apply them to developer workflows.
• Security certifications (e.g., CISSP, CISA, relevant vendor certifications).
• Familiarity with compliance frameworks relevant to software vendors (SOC 2).
  
  

Why join JetBrains?

JetBrains provides a highly technical and intellectually stimulating environment. You'll work on identity and access management systems used by millions of developers, with the opportunity to work with cutting-edge technologies every day. Help us keep our tools and systems secure. 
We offer:

• Strong base salary. We offer competitive pay that reflects your skills and experience.
• Flexible work location. Enjoy the freedom to work from home or from the office.
• Remote work. Spend up to 30 days per year working remotely from abroad.
• Extra time off. More days to relax, recharge, and do the things you love.
• Medical insurance allowance. Enjoy peace of mind for you and your family.
• Learning and development opportunities. Access to conferences, courses, and language classes.
• Relocation support. We help make your move as smooth and stress-free as possible.
• Language classes. Pick up the local language or sharpen your English skills.
• Fuel your day. Enjoy a hot meal or receive a lunch allowance on workdays.
• Mental health support. To help you feel your best, we provide easy access to professional mental health services.
• Sports benefit. Enjoy an on-site gym or sports club stipend.
• Internal events. Join company-wide celebrations and team gatherings.

*Some benefits may vary depending on location.
#LI-DNI