OfferDrill.

Jobs › DRW

Staff IAM Engineer

DRW · Chicago, IL · $150,000–$200,000 a year · IO – IAM Engineering

Posted Sep 18, 2026 · We last checked this listing on Oct 6, 2026

Apply at DRW

Likely interview questions for this role

Written from this job description, not a generic list. Each one notes what the interviewer is really checking.

About your past

Tell me about the biggest identity project you have led. What went wrong and how did you recover?

What they are checking: Staff-level ownership and honesty about how large identity programs actually go.

How do you get other teams to adopt identity standards when you do not manage them?

What they are checking: Influence without authority, which a staff engineer on a new team needs to drive change.

What would you do

The IAM team is new and will own DRW's identity capabilities. If you joined on day one, what would you look at first, and what would your first ninety days produce?

What they are checking: Whether they can assess an identity landscape and set priorities when there is no existing team or playbook.

How would you roll out stronger authentication, like phishing-resistant MFA, without slowing traders down?

What they are checking: Balancing real security gains against the cost of friction for people whose minutes matter.

A business leader wants an exception to an access policy for a trading deadline. How do you respond?

What they are checking: Whether they can offer a safe, time-limited path instead of a flat no or a quiet permanent exception.

About the work

The team is meant to advance agentic identity. How should an AI agent acting on a person's behalf be authenticated and authorized?

What they are checking: Current thinking on delegated access, scoped tokens and auditability for non-human actors, an emerging problem the posting names.

Walk me through how you would design authorization for a firm where traders, researchers and engineers need very different access.

What they are checking: Whether they can choose between role, attribute and policy-based models and keep them manageable as the firm changes.

How do you handle joiner, mover and leaver processes so access is accurate and removed on time?

What they are checking: Understanding of lifecycle automation tied to HR data, since stale access is a common audit and breach finding.

How would you protect service accounts and machine credentials across on-prem and cloud?

What they are checking: Knowledge of secrets management, rotation and workload identity, which often matters more than human logins.

The team may expand into customer identity and access management. How is CIAM different from workforce identity?

What they are checking: Whether they understand scale, self-service, privacy and user experience concerns that set CIAM apart.

What identity protocols do you know deeply, and where have you seen OAuth or SAML implemented badly?

What they are checking: Real protocol depth that lets them spot misconfigurations, not just configure vendor screens.

Practice this interview out loud.

Offer builds a real interview for this exact role at DRW from your resume and this job description, asks the questions one at a time, and tells you what landed. The first one is free.

Practice this out loud

The full job description

As published by DRW.

DRW is a diversified trading firm with over 3 decades of experience bringing sophisticated technology and exceptional people together to operate in markets around the world. We value autonomy and the ability to quickly pivot to capture opportunities, so we operate using our own capital and trading at our own risk. Headquartered in Chicago with offices throughout the U.S., Canada, Europe, and Asia, we trade a variety of asset classes including Fixed Income, ETFs, Equities, FX, Commodities and Energy across all major global markets. We have also leveraged our expertise and technology to expand into three non-traditional strategies: real estate, venture capital and cryptoassets. We operate with respect, curiosity and open minds. The people who thrive here share our belief that it’s not just what we do that matters–it's how we do it. DRW is a place of high expectations, integrity, innovation and a willingness to challenge consensus. The Team: &nbsp; The IAM Team is a net-new, vanguard group&nbsp;that will&nbsp;own, implement, and drive DRW’s comprehensive identity capabilities, aligning them to evolving business requirements. This dedicated group collaborates with stakeholders to advance agentic identity, enhanced authentication and authorization controls, and other emerging identity and security innovations, with potential expansion into customer identity and access management (CIAM). &nbsp; The Role: &nbsp; We are seeking an experienced Identity Engineer to own the delivery, operation, and continuous improvement of our enterprise authentication and authorization services. The IAM team&nbsp;is responsible&nbsp;for&nbsp;the&nbsp;security,&nbsp;compliance, availability, and user experience&nbsp;of these services;&nbsp;you'll&nbsp;execute implementations,&nbsp;participate&nbsp;in&nbsp;and influence&nbsp;design decisions, and ensure integrations across&nbsp;on ‑ prem&nbsp;and cloud environments meet SLAs and control requirements. The role focuses on SSO, federation, MFA, and secure access management. &nbsp; Key Responsibilities: &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="3" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="1" data-aria-level="1"> Own, implement, and&nbsp;operate&nbsp;end-to-end enterprise authentication and federation solutions;&nbsp; drive architecture reviews and collaborate to influence design decisions , ensuring security, compliance, availability, and performance. &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="13" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="1" data-aria-level="1"> Implement, configure, and support SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), LDAP, and&nbsp;JWT ‑ based&nbsp;integrations. &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="13" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="2" data-aria-level="1"> Integrate identity solutions with enterprise,&nbsp;third ‑ party&nbsp;applications, APIs, SaaS platforms, and custom web/mobile apps, including SSO, provisioning (SCIM/API), and secure API authentication. &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="13" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="3" data-aria-level="1"> Implement MFA, adaptive authentication,&nbsp;fine ‑ grained&nbsp;access policies, and authorization models that meet security standards. &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="13" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="4" data-aria-level="1"> Support identity lifecycle and directory integrations with IAM and directory services (e.g., Entra ID/Azure AD, Active Directory, ADFS) and provisioning systems. &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="13" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="5" data-aria-level="1"> Troubleshoot authentication/authorization flows; perform&nbsp;root ‑ cause&nbsp;analysis, incident response, and performance tuning. &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="13" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="6" data-aria-level="1"> Ensure compliance with security, audit, and regulatory requirements and support related assessments. &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="13" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="7" data-aria-level="1"> Collaborate closely with security, infrastructure, application, and&nbsp;DevOps teams to deliver and&nbsp;operate&nbsp;identity services. &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="13" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="8" data-aria-level="1"> Create and&nbsp;maintain&nbsp;runbooks, SOPs, operational procedures, and technical documentation. &nbsp; Required Qualifications: &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="18" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="1" data-aria-level="1"> Strong&nbsp;written and verbal communication, stakeholder management, and&nbsp;cross ‑ team&nbsp;collaboration skills. &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="21" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="1" data-aria-level="1"> 5+ years of experience in Identity & Access Management (IAM), or equivalent hands-on experience. &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="21" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="2" data-aria-level="1"> Strong hands-on experience implementing and&nbsp;operating&nbsp;commercial identity&nbsp;platforms and&nbsp;enterprise identity services (Ping AIC and PingFederate preferred, or the ability to implement required features in Ping). &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="21" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="3" data-aria-level="1"> Deep knowledge of SSO, federation, and authentication/authorization protocols (SAML 2.0, OAuth 2.0, OpenID Connect, JWT). &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="21" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="4" data-aria-level="1"> Experience integrating with directory and lifecycle systems (Active Directory/LDAP, Azure AD/Entra ID, ADFS) and provisioning (SCIM/API). &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="21" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="5" data-aria-level="1"> Practical experience with MFA, adaptive authentication, fine-grained authorization, and access policy enforcement. &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="21" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="6" data-aria-level="1"> Strong troubleshooting skills across authentication flows, certificates, TLS, networking, and related infrastructure. &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="21" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="7" data-aria-level="1"> Scripting/automation skills (Shell, Python, Go, PowerShell) and familiarity with&nbsp;IaC/CI-CD tools (Terraform, Ansible, or similar). &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="21" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="8" data-aria-level="1"> Comfortable working in Linux environments and producing operational runbooks and technical documentation. &nbsp; Bonus Points: &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="21" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="9" data-aria-level="1"> Experience in banking or financial services (regulated enterprise environments). &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="21" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="10" data-aria-level="1"> Hands ‑ on&nbsp;cloud experience (AWS, Azure/Entra, or GCP) and container platforms (Docker, Kubernetes). &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="21" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="11" data-aria-level="1"> Experience with API security, OAuth/OIDC for APIs, and&nbsp;zero ‑ trust&nbsp;architectures/use cases. &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="21" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="12" data-aria-level="1"> Practical experience with CIAM or customer identity projects. &nbsp; <li data-leveltext="" data-font="Symbol" data-listid="21" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="13" data-aria-level="1"> Ping Identity certifications or other security/identity certifications. &nbsp; • <li data-leveltext="" data-font="Symbol" data-listid="21" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="14" data-aria-level="1"> Observability and monitoring experience for identity services (Prometheus, ELK, Splunk, etc.) &nbsp; The annual base salary range for this position is $150,000 to $200,000 depending on the candidate’s experience, qualifications, and relevant skill set. The position is also eligible for an annual discretionary bonus. In addition, DRW offers a comprehensive suite of employee benefits including group medical, pharmacy, dental and vision insurance, 401k (with discretionary employer match), short and long-term disability, life and AD&D insurance, health savings accounts, and flexible spending accounts. For more information about DRW's processing activities and our use of job applicants' data, please view our Privacy Notice at https://drw.com/privacy-notice . California residents, please review the California Privacy Notice for information about certain legal rights at https://drw.com/california-privacy-notice . [#LI-LD1] &nbsp;

Apply at DRW