Lead Platform Engineer, Identity & Access

Webflow is the agentic web marketing platform for modern marketing teams, helping organizations build, manage, and optimize high-performing web experiences that drive predictable growth and strengthen brand trust. Building at Webflow will need grit, because we move fast, without ever sacrificing craft or quality.

Webflow is looking for a Lead Platform Engineer, Identity & Access to own how our workforce, devices, and automations authenticate and get access to what they need. Okta is our primary identity platform, and you’ll take it from a tool that works to a platform that is deliberately architected, governed, and easy to build on.

You’ll partner extensively with Security on policy, risk, and detection, bringing the engineering depth to turn their requirements into systems that run reliably. Making access safe by default without slowing people down is the central challenge of the role.

ABOUT THE ROLE:

- Location: Remote-first (United States) - Full-time - Permanent - Exempt - The cash compensation for this role is tailored to align with the cost of labor in different geographic markets. We've structured the base pay ranges for this role into zones for our geographic markets, and the specific base pay within the range will be determined by the candidate’s geographic location, job-related experience, knowledge, qualifications, and skills. - United States (all figures cited below are in USD and pertain to workers in the United States) - Zone A: $232,000 - 290,000 - Zone B: $217,600 - 272,000 - Zone C: $204,800 - 256,000

This role is also eligible to participate in Webflow's company-wide bonus program. Target amounts are a percentage of base salary and vary by career level. Payouts are based on company performance against established financial and operational goals.

Please visit our Careers page https://webflow.com/careers#pay-zones for more information on which locations are included in each of our geographic pay zones. However, please confirm the zone for your specific location with your recruiter.

- Application Information: - Application deadline: applications accepted on an ongoing basis until position is closed and filled - This posting is for a new position - Reporting to the Senior Director, Information Technology

AS A LEAD PLATFORM ENGINEER, IDENTITY & ACCESS, YOU’LL:

- Own the identity architecture and roadmap for workforce identity, with Okta as the core platform, including build versus buy decisions - Bring our Okta tenant under proper management, with configuration standards, hardening, change control, and configuration as code (Terraform, APIs, Okta Workflows, or scripts where the platform falls short) - Automate the identity lifecycle from joiner to leaver, using our HRIS as the source of truth and SCIM to downstream applications - Build paved roads for application onboarding, including standard SSO patterns, provisioning templates, and federated access to our cloud and source control platforms, so app owners can integrate without platform team involvement - Design the access model: role based access control (RBAC), least privilege, request and approval workflows, and access reviews, with tooling that answers “who has access to what, and why” and produces audit evidence automatically - Strengthen how access is granted through phishing resistant MFA, device trust and risk signals, and governed non human identities (service accounts, tokens, OAuth grants, and AI tools and agents), and stream identity telemetry to Security for detection and response - Serve as the top escalation point and primary responder for identity incidents and outages should they arise, including on call coverage for critical identity services, post incident reviews, and log analysis with Security - Manage the Okta vendor relationship, licensing, and cost