I build and run enterprise identity platforms. Workforce login, privileged access, and a record of who did what.
At HEB Digital I lead IAM for 180K+ employees: Okta as the main IDP, Teleport rolling out to ~5K on-prem servers, and Terraform so app teams can onboard without waiting on a central queue.
Workforce
180K employees
900+ apps
Okta
Login, joiner/mover/leaver, and access reviews.
Servers
~5K on-prem servers
Teleport
Linux and Windows. Owners approve access. Sessions are recorded.
Services and agents
Service accounts, API clients, and agents
OAuth and OPA
An owner, a limit on what it can do, and a log.
App teams
Terraform
Add an app without a ticket for every change.
Privileged users
PCI MFA
Clutch and CrowdStrike are on this path.
Rolling Teleport out to ~5K on-prem Linux and Windows servers. Server owners approve who gets in. Roles are basic, elevated, or a short-lived admin. Sessions are recorded, and hosts are tagged by service, environment, and compliance.
Who can reach a host or an API, and for how long. Teleport, Clutch, CrowdStrike, and OPA. PCI MFA for privileged users is part of this.
Service accounts, API clients, and OAuth for APIs. Agents that call those APIs are in this work too.
A lot of the work is a service account, an API client, or a privileged login. When an agent acts for a person or a system, it gets the same treatment: an owner, a limit on what it can do, and a log.
HEB programs. The rest of the timeline is under Experience.
Workforce login was split across OneLogin, on-prem ADFS, and other paths. Hard to govern and hard to support.
Cut over in waves, with an inventory and an owner for each app. About 500 apps came from OneLogin, and 200+ from ADFS. One primary IDP, without a long outage.
ResultOkta is the primary workforce IDP for 900+ apps.
Joiner, mover, and leaver work, and the access reviews, were manual. Audit season was a scramble.
Okta Identity Governance handles lifecycle, access requests, and certification campaigns.
ResultJoiner, mover, leaver, requests, and certification campaigns run in Okta IG.
Linux access ran through broad AD groups and domain joins. Ownership was unclear, and reviews were painful.
We piloted it first: an inventory, agents enrolled, access lists owned by the server owners, and exceptions written down. The rollout follows that.
ResultRolling out to ~5K on-prem Linux and Windows servers. Roles are owner-managed, sessions are recorded, and hosts are tagged.
Every new app, and a lot of day-2 changes, sat in a central IAM queue. Product teams waited. The help desk emailed us for routine checks.
IAM config is in Terraform, with a self-service path for onboarding. The help desk has checks it can run without an engineer.
ResultApp teams can onboard without a ticket for every change. Routine help-desk checks no longer wait on IAM.
Most of my career has been identity. Ten years of it was Oracle Identity Cloud. At HEB I am modernizing IAM for a much larger workforce.
Rebuilding IAM for a large retail workforce: one primary IDP, governance, and privileged access for people and for machines. I hired the security engineering team for it. The programs are in Selected work.
Spent a decade on Oracle’s multi-tenant Identity Cloud. Work covered SSO, federation, MFA, and customer identity for apps across the cloud portfolio.
Architecture work on loan servicing and investor reporting.
Consulting architect for enterprise clients.
WiQuest (intern, 2006): test automation for wireless devices and WHQL certification with Microsoft. Cognizant (2004–2005): support engineer on AMEX card services. Watched the network, fixed issues, hit the SLA.
Email me about an IAM program, privileged access, or running an identity team.