MTS Lead, Identity and Access Management

The posting, as Reflection wrote it

OUR MISSION

Reflection is a research lab making intelligence open and accessible for everyone to use, customize, and build on. We build open models that let anyone control their intelligence and help shape the future of AI. Our mission: make intelligence open and accessible to all.

ROLE OVERVIEW

The Head of Identity and Access Management is responsible for architecting, building, and operating Reflection’s identity infrastructure — the foundational security layer in an environment where the perimeter is entirely identity-based and the threat model includes sophisticated, highly motivated nation-state actors targeting intellectual property, training pipelines, and model weights. This leader will design and operate a bleeding-edge, zero-trust identity architecture that treats identity as software, eliminates static credentials, and protects Reflection’s researchers and massive-scale compute environments without introducing friction.

This is not a traditional enterprise IAM or Active Directory management role. The ideal candidate is a security architect and software engineer in equal measure — capable of mandating hardware-backed phishing-resistant authentication globally, building just-in-time credentialing systems for GPU cluster access, and engineering dynamic, context-aware authorization pipelines that hold up against the most advanced adversary techniques. They bring first-principles cryptographic depth, cloud-native mastery, and the software engineering capability to build custom tooling where commercial solutions fall short.

This is a high-stakes, high-visibility role at the center of Reflection’s security posture. Success requires the ability to build identity infrastructure that is simultaneously state-of-the-art in its security guarantees and genuinely developer-friendly in its design — because at Reflection, security that slows down a researcher is security that has failed.

WHAT YOU'LL DO

Next-Generation IAM Architecture

• Design and implement a resilient, cloud-native identity architecture leveraging modern IdPs (Okta, OIDC/OAuth 2.0 federations) unified with edge-enforced zero-trust access networks (Cloudflare Access, Tailscale / WireGuard topologies).
• Architect and continuously evolve the organization’s identity boundary with a first-principles approach — replacing legacy constructs with modern, cryptographically-grounded alternatives at every layer.
• Own the full identity lifecycle architecture across corporate, production, and research environments, ensuring consistency, auditability, and resilience across all access surfaces.

Phishing-Resistant Zero Trust

• Mandate and enforce hardware-backed authentication (YubiKeys/WebAuthn) globally across all corporate, production, and research endpoints.
• Eliminate SMS, TOTP, and legacy MFA bypass vectors — driving the organization to a posture where phishing-resistant authentication is the only path.
• Design and operate zero-trust access controls that enforc

[…]
ife & family: 22 weeks paid parental leave for all new birthing and non-birthing parents, including adoptive and surrogate journeys.

• Vacation days: Unlimited paid time off in the U.S. and 30 days in the U.K.
• Sponsorship support: We sponsor visas to help exceptional talent join our team and support long-term immigration pathways where applicable.
• Team building: We have regular off-sites, happy hours, and team celebrations.

Export Control Notice: This position may require access to technology or source code subject to the U.S. Export Administration Regulations. Any offer of employment for this role may be conditioned on the Company's ability to provide the candidate with access to such technology or source code in compliance with applicable U.S. export control laws, which may require the Company to seek government authorization.

Equal Employment Opportunity Statement
Reflection AI is an equal opportunity employer. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), sexual orientation, gender identity or expression, national origin, ancestry, age, marital status, disability, genetic information, veteran or military status, or any other characteristic protected by applicable law. We encourage applicants from all backgrounds to apply.

We provide reasonable accommodations throughout the hiring process for applicants with disabilities, pregnancy-related limitations, or religious needs. If you need an accommodation, contact us at accommodations@reflection.ai.

We will consider for employment qualified applicants with arrest and conviction records in accordance with applicable law, including the San Francisco Fair Chance Ordinance and the California Fair Chance Act.

Candidate and Employee Privacy Notice: We collect and process personal data about applicants for the purposes described in our Candidate and Employee Privacy Notice https://cdn.sanity.io/files/irpbdun9/production/ee08c38bf22bd45a3f3a81f6a7abddb9210726b7.pdf