Manager, IAM Security Operations, Trust & Safety

ABOUT THE ROLE
We're looking for an IAM Security Operations Manager to lead Shopify's Worker Identity function within the Security team. You'll lead a team of security analysts and system admins across Shopify's worker identity program — and own the systems, processes, and risk intelligence that ensure the right people have the right access at the right time, and nobody else does.
YOUR KEY AREAS OF OWNERSHIP
- Own the end-to-end access lifecycle and risk analysis for workers of all types — provisioning, deprovisioning, transfers, access, entitlements, and ongoing risk assessments across Shopify's systems
- Own the IAM analysis function — identifying overprivileged and anomalous access, and producing the risk intelligence that informs access decisions across Shopify
- Lead, develop, and grow the worker identity team as the work requires, setting clear expectations, removing blockers, and driving high performance through direct feedback
- Own operational metrics and use data to drive workflow improvements
- Manage IAM tooling operations and drive automation to reduce manual toil
- Own and continuously improve the controls, builds, and monitoring that keep Shopify's access environment secure and observable
- Build and maintain playbooks, ensuring consistent operations and decision making
- Own the worker identity roadmap — defining what the team focuses on and how to mitigate risk
- Support an on-call rotation, ensuring IAM operational issues are triaged and resolved quickly
- Partner cross-functionally with IT, Security Engineering, Privacy, Legal, Talent, and Compliance to align you team’s work with broader Trust and Shopify objectives
YOU WILL
- Be obsessed with reducing risk for Shopify — every process you build, every control you operate, every tool you improve ties back to that
- Ruthlessly prioritize operational work, keep the team focused on what matters most and stop everything else
- Proactively seek out gaps, inefficiencies, and risks before they become problems and ship fixes fast — better runbooks, faster SLAs, fewer manual steps
- Surface problems and gaps early with proposed solutions, not just flags
- Dive deep into the details of every access workflow, escalation, and edge case your team handles
- Use AI reflexively to accelerate operations, automate repetitive tasks, and solve problems faster
- Build a high-trust team through regular feedback, clear expectations, and accountability
- Mentor your team members, raise the bar on quality, and develop them into go-to experts in their areas
- Be meticulous in documentation and context capture so others can pick up work without losing time
TO BE SUCCESSFUL YOU WILL NEED
- Experience managing a security or IAM team, with a track record of building high-performing teams and growing headcount as scope expands
- Deep understanding of identity lifecycle management across employees and non-employees — RBAC/ABAC models, access governance, and contractor and vendor offboarding
- Track record of improving operational metrics and reducing toil — consistent execution with a bias toward fixing what's broken
- Hands-on familiarity with IAM tooling (e.g. Okta, Google) and protocols (e.g. SAML, SCIM, OIDC)
- Strong, crisp communication across decisions, playbooks, and everything in between.
NICE TO HAVE
- Experience in threat detection and third party risk management
- Background in compliance frameworks (SOC 2, SOX, ISO 27001) as they relate to access controls
- Experience operating IAM at scale in a cloud-native environment (GCP, AWS)
- Familiarity with one or more of the following tools: Google, Okta, Fleet, Slack, Freshworks, macOS, Workday, and GitHub