Manager, IAM Security Operations, Trust & Safety

About the Role

We're looking for an IAM Security Operations Manager to lead Shopify's Worker Identity function within the Security team. You'll lead a team of security analysts and system admins across Shopify's worker identity program — and own the systems, processes, and risk intelligence that ensure the right people have the right access at the right time, and nobody else does.

Your Key Areas of Ownership

• Own the end-to-end access lifecycle and risk analysis for workers of all types — provisioning, deprovisioning, transfers, access, entitlements, and ongoing risk assessments across Shopify's systems

• Own the IAM analysis function — identifying overprivileged and anomalous access, and producing the risk intelligence that informs access decisions across Shopify

• Lead, develop, and grow the worker identity team as the work requires, setting clear expectations, removing blockers, and driving high performance through direct feedback

• Own operational metrics and use data to drive workflow improvements

• Manage IAM tooling operations and drive automation to reduce manual toil

• Own and continuously improve the controls, builds, and monitoring that keep Shopify's access environment secure and observable

• Build and maintain playbooks, ensuring consistent operations and decision making

• Own the worker identity roadmap — defining what the team focuses on and how to mitigate risk

• Support an on-call rotation, ensuring IAM operational issues are triaged and resolved quickly

• Partner cross-functionally with IT, Security Engineering, Privacy, Legal, Talent, and Compliance to align you team’s work with broader Trust and Shopify objectives

You Will

• Be obsessed with reducing risk for Shopify — every process you build, every control you operate, every tool you improve ties back to that

• Ruthlessly prioritize operational work, keep the team focused on what matters most and stop everything else

• Proactively seek out gaps, inefficiencies, and risks before they become problems and ship fixes fast — better runbooks, faster SLAs, fewer manual steps

• Surface problems and gaps early with proposed solutions, not just flags

• Dive deep into the details of every access workflow, escalation, and edge case your team handles

• Use AI reflexively to accelerate operations, automate repetitive tasks, and solve problems faster

• Build a high-trust team through regular feedback, clear expectations, and accountability

• Mentor your team members, raise the bar on quality, and develop them into go-to experts in their areas

• Be meticulous in documentation and context capture so others can pick up work without losing time

To Be Successful You Will Need

• Experience managing a security or IAM team, with a track record of building high-performing teams and growing headcount as scope expands

• Deep understanding of identity lifecycle management across employees and non-employees — RBAC/ABAC models, access governance, and contractor and vendor offboarding

• Track record of improving operational metrics and reducing toil — consistent execution with a bias toward fixing what's broken

• Hands-on familiarity with IAM tooling (e.g. Okta, Google) and protocols (e.g. SAML, SCIM, OIDC)

• Strong, crisp communication across decisions, playbooks, and everything in between.

Nice to Have

• Experience in threat detection and third party risk management

• Background in compliance frameworks (SOC 2, SOX, ISO 27001) as they relate to access controls

• Experience operating IAM at scale in a cloud-native environment (GCP, AWS)

• Familiarity with one or more of the following tools: Google, Okta, Fleet, Slack, Freshworks, macOS, Workday, and GitHub