Senior IT Platform Engineer

Senior IT Platform Engineer

Beast Industries · San Mateo, CA (on-site 4 days/week at Step) · Full-time · Reports to the Director of IT

Identity & Application Lifecycle

ABOUT THE ROLE

Beast Industries is the company behind MrBeast, Feastables, Beast Games, and a growing family of businesses that now includes Step, the fintech platform helping the next generation build credit and manage money. We're unifying identity across that whole family. Hundreds of SaaS applications and hundreds of employees are converging onto a single Okta instance while regulated, compliance-sensitive systems stay properly isolated.

You'll be the engineer working deep inside that platform. You'll know how users and applications get onboarded, provisioned, secured, and retired across every Beast company, and you'll run point for Step. That means the HRIS-driven provisioning that feeds it, the SSO and SCIM integrations for its app stack, and the dual-instance boundary that keeps its regulated systems separate from the rest of the business. This is a hands-on engineering role, not an administrator seat. You'll think in APIs, scripts, and pipelines, and you'll build automation so lifecycle events run themselves.

You'll also anchor the West Coast for the Beast IT team, working from Step's San Mateo office about four days a week. The office runs on you being there. You're the face of IT for the region, the first call when something breaks, and the person who makes sure exec visits and events go off without a hitch.

WHAT YOU'LL DO

Identity platform engineering

• Run the user lifecycle end to end. Design and operate automated joiner, mover, and leaver flows for new hires, department changes, contractors, rehires, offboarding, and MFA enrollment, driven by HRIS events across multiple payroll and HR platforms.
• Drive the application lifecycle. Onboard, integrate, maintain, and decommission apps across an inventory of several hundred SaaS applications, dozens of them federated for SSO and SCIM coverage growing, including our multi-workspace Slack environment. SAML, SCIM, and SWA configurations are your daily work.
• Engineer identity automation. Manage groups, group rules, and sign-on and authentication policies, and build the automation that keeps them honest. Work fluently within the dual-instance architecture that isolates regulated fintech systems like KYC, brokerage, and banking integrations from the general business stack.
• Run point for Step. Be the go-to engineer for how Step connects to the central Beast stack. Scope new integrations, keep the production ones healthy, and take first swing when something between Step and Beast breaks.
• Document like an engineer. Maintain runbooks, architecture diagrams, and knowledge base articles, and keep the application inventory accurate enough to be a real system of record.

Site support and operations

• Own the San Mateo queue. Triage, resolve, and escalate against SLAs in Serval, our Slack-native ITSM platform. The queue is yours, including the numbers behind it.
• Run the site. New hire desks ready before day one, device provisioning and depot, peripheral and asset inventory. Small problems compound when nobody watches them. You watch them.
• Keep the rooms working. Conference rooms, Zoom Rooms, Rally Bars, town hall AV. Meetings start on time because you made sure they would, and when an all-hands goes sideways, you're the one who gets it back.
• Take care of the people. Walk-up questions, patient help for the less technical, showing a new hire how things work here, spotting the person quietly struggling with a tool and fixing it before they file a ticket. The general care and feeding of an office full of users is real work, and it's yours.
• Be the face of IT for the West Coast. You're the on-site escalation point for the region and the white-glove support for exec visits and company events, occasionally available after hours when the moment calls for it.

WHAT WE'RE LOOKING FOR

• 5+ years in IT systems, identity, or infrastructure engineering with deep hands-on Okta administration. Groups, policies, SSO/SAML, SCIM, lifecycle management. Comfortable on macOS and Windows alike.
• Proven automation in Okta Workflows or equivalent (e.g. Tines, Serval), including building against APIs directly when the platform runs out of buttons.
• Strong scripting and API skills in Python, PowerShell, or JavaScript for bulk operations, data transformation, and integrations.
• Federation fluency. You've integrated SaaS apps via SAML, OIDC/OAuth, and SCIM enough times that the edge cases don't surprise you.
• HRIS-driven provisioning experience with real joiner/mover/leaver automation in production, not just a proof of concept.
• DevOps discipline. Version control, CI/CD concepts, infrastructure as code, and cloud platforms (AWS and/or GCP).
• Endpoint awareness. Working knowledge of MDM (Intune, FleetDM preferred) and device trust.
• AV fluency. Comfortable deploying and troubleshooting conference room systems like Zoom Rooms and Logitech Rally Bar.
• A real service streak. You're happy being the person people find when something breaks, and you're as sharp with an exec's dead laptop as with a broken SCIM integration.
• Comfort in a regulated, multi-entity environment. Fast-moving doesn't excuse sloppy. You know how to move quickly inside compliance boundaries.
• Proven use of AI tooling for IT work such as Claude (Cowork and Code) and GenSpark.

NICE TO HAVE

• Certifications or deep admin experience in Okta, Google Workspace, Slack, or Jira. Okta Workflows or Consultant certifications especially welcome.
• Tenant migrations or SaaS consolidation at scale. You've merged, split, or collapsed identity platforms before and have the scars to prove it.
• Experience supporting developer environments. GitHub and CI administration, developer tool provisioning, and enough context to speak an engineer's language.
• Fintech and compliance tooling familiarity. KYC, brokerage, fraud and identity decisioning, audit-trail separation.
• Google Workspace and Microsoft 365 dual-domain administration.
• Slack Enterprise Grid or multi-workspace SCIM experience.
• Security tooling exposure.

SUCCESS IN THE FIRST SIX MONTHS

• Automated lifecycle workflows cover the core joiner, mover, and leaver events and routine identity changes need no human hands.
• The application inventory is accurate and maintained with provisioning and deprovisioning documented per app.
• The San Mateo queue runs against its SLAs and the office treats IT as something that just works. Desks ready before day one, rooms that start on time, an escalation path people trust.

WHAT MAKES THIS ROLE DIFFERENT

Identity engineers rarely get this mix. Deep, hands-on work across a multi-company identity platform with a fintech compliance boundary running through the middle of it, at a company whose name everyone you know recognizes. You'll ship work that would be committee-bound anywhere else, and because you're in the office with the people who use it, you'll see it land firsthand.

The target total compensation ranges from $115,000– $172,500, including an employee equity plan grant, bonus, plus comprehensive benefits.
Equity grants are issued in good faith, subject to company policies, board approval, and individual eligibility.