Identity Access Management & Data Protection Specialist

At Flowdesk, we are building the infrastructure powering the next era of global finance. As a full-service digital asset trading and technology firm, we provide liquidity solutions, OTC trading, and market infrastructure that connect digital assets to global markets with institutional-grade precision, transparency, and scale. Flowdesk combines expertise from traditional finance, algorithmic trading, and blockchain technology to deliver always-on trading capabilities across the digital asset ecosystem.

Identity is the main control point across our SaaS, cloud and internal systems. The Security team makes sure access to sensitive systems is tightly controlled and provable to auditors and regulators, and that the data behind those systems is protected.

In this role you will plan, build and run our identity provider setup and single sign-on estate, including Identity Governance and Administration (IGA) for all Flowdesk identities. You will also cover Data Protection - data encryption, PKI, Key Management, data classification and DLP from a plan, build and run perspective.

Responsibilities

• Own the identity provider and SSO estate: onboarding applications, enforcing MFA, and keeping SAML, OIDC and SCIM integrations healthy
• Design and run Authentication and Access Management for our own products and internal tools, including OAuth 2.0 flows, token handling and session policy, through Terraform and infrastructure as code where possible
• Plan and deliver identity projects, such as IdP consolidation, passwordless, conditional access, IGA and JML automation
• Contribute to the joiner, mover and leaver process across the organisation, working with IT Operations, HR and application owners so access follows role and is removed promptly
• Design and implement Data Classification, DSPM and DLP capabilities
• Design and manage data protection solutions such as HSMs, Key Management, Secrets and Password Management, and PKI-related solutions
• Design and run privileged access management (PAM) and just-in-time (JIT) access, so elevated access is granted for a set purpose and time, approved, logged and removed automatically
• Help run regular access review campaigns and manage break-glass accounts and service account governance
• Review application and API authentication designs with Secure Engineering, and advise teams on best practice implementation
• Produce evidence and reporting for audits and regulators
• Monitor identity logs for abuse, and help respond to account compromise
• Work as part of the wider security team, and cover gaps in other areas when they arise, such as during absences, incidents or peaks in workload

Requirements

• Several years in identity security and data protection, with hands-on delivery of an IdP and SSO rollout
• Deep working knowledge of SAML, OIDC, OAuth 2.0, SCIM and JWT, including common implementation mistakes
• Experience with at least one enterprise identity provider and one customer or application identity platform
• Experience with PAM and JIT access, ideally for cloud, SaaS and production environments
• Experience with the joiner, mover and leaver process, and an understanding of how it works across HR, IT and application teams
• Solid understanding of Terraform and infrastructure as code, and the ability to work day to day in an environment where infrastructure is managed that way
• Scripting skills (required for the role)
• General security knowledge across the main domains
• A process-oriented approach: you document what you do, follow change control, and leave an audit trail
• Clear writing, since much of the job is documenting decisions and explaining them to auditors and engineers
• Willingness to work across the security team and learn adjacent areas, such as incident response, GRC evidence or cloud security, as needed
• Pragmatic and automation-minded: prefers infrastructure as code and scripting over manual change
• Holds a high bar for control and evidence in a regulated, high-trust environment
• Nice to have: Experience working in a regulated, controlled environment, such as financial services or crypto
• Nice to have: Customer identity (CIAM) experience
• Nice to have: Machine identity and secrets management in cloud and Kubernetes
• Nice to have: Agentic AI access management
• Nice to have: Relevant certifications (CISSP, CISM, CEH or similar)

Benefits

• International environment (English is the main language)
• 100% health coverage
• Team events and offsites
• Company Pension scheme
• Learning and Development budget

We analyzed this company's recent hires, and it passed our analysis. DYOR.