Technical Security Analyst, IAM

We’re looking for a curious, detail-oriented Technical Security Analyst to join Shopify’s Identity and Access Management (IAM) team.

As a Technical Security Analyst on IAM, you’ll help operate, monitor, and improve the security systems and workflows that manage corporate identities and govern access across Shopify. You’ll play a critical role in ensuring Shopifolk have the right access to do their work securely, while reducing identity and access risk across our global operations, platforms, and products.

You’ll collaborate with engineers, system administrators, security teams, compliance partners, and other cross-functional teams to protect Shopify and our merchants while supporting the pace at which Shopify ships. You’ll build deep context on Shopify’s products, applications, and infrastructure, and use that context to analyze risk, improve controls, and create repeatable ways of working.

Your key areas of ownership will include:

• IAM control operations — Monitor, audit, and improve access controls that govern corporate identities and access across Shopify.

• Access disruption and incident response — Respond to IAM-related access issues and incidents, coordinating timely action items with engineering, IT, and security partners.

• Risk reduction and control improvement — Analyze current and future IAM controls to identify gaps, reduce risk, and improve control effectiveness.

• Automation and workflow improvement — Automate repetitive security workflows, reduce toil, and improve how the team operates access governance and control monitoring.

• Evidence, metrics, and reporting — Use data, dashboards, and documentation to understand program health, support assessments, and communicate security impact.

• Playbooks and best practices — Follow, maintain, and improve IAM playbooks for access reviews, control monitoring, incidents, and operational workflows.

In this role, you will:

• Provide operational security guidance and perform audits to ensure controls are functioning effectively, efficiently, and without gaps.

• Analyze the security and employee impact of IAM controls, workflows, and access policies.

• Monitor Shopify’s technology stack and recommend ways to reduce identity and access risk.

• Collaborate with cross-functional teams to gather evidence for assessments, implementations, and new tools or workflows.

• Lead and contribute to projects that build out and harden IAM security at Shopify.

• Use data and key metrics to understand program health, identify trends, and measure the impact of security improvements.

• Be meticulous in documentation and context capture, including decision rationale, control evidence, workflow updates, and playbook improvements.

• Mentor teammates, share IAM and security best practices, and help raise the bar for how the team operates identity and access controls.

Qualifications

To be successful, you will need:

• Understanding of information security fundamentals, privacy principles, and compliance standards.

• Experience working with corporate identity providers at scale.

• Ability to use AI tools reflexively to accelerate analysis, automate workflows, improve documentation, and solve technical security problems.

• Strong communication skills, including the ability to translate complex technical configuration, code, control behavior, and risk into clear recommendations.

• Experience working with metrics, or dashboards to analyze systems, controls, or security program health.

• Experience performing technical or security control assessments and turning findings into practical remediation plans.

• Experience writing, reviewing, or improving access policies, standards, or procedures.

• Experience monitoring security controls and safeguards mapped to common frameworks or compliance requirements.

• Strong documentation habits and the ability to create durable, reusable context for teammates and stakeholders.

• Strong sense of accountability for the quality, timeliness, and security impact of your work.

Nice to Have:

• Proven track record of synchronizing identity data across HRIS, directories, SaaS ecosystems, and security tooling.

• Deep familiarity with zero-trust architectures and their practical implementation within workforce identity management.

• Experience establishing health metrics for security controls, SLIs, and indicators for operational identity risk.

• Hands-on knowledge of cloud-native IAM frameworks within environments like AWS or Google Cloud Platform.

• History of successful collaboration with cross-functional partners in legal, privacy, compliance, and internal audit.

• Ability to perform rigorous root-cause analysis to transform security incidents into permanent control enhancements.

• Skilled at optimizing security workflows while maintaining a low-friction experience for employees.

• Active interest in the evolution of identity threats, defensive innovations, and modern adversary techniques.