I build and run enterprise identity platforms. That covers workforce login, privileged access, and the plumbing that keeps them honest.
At HEB Digital I lead IAM for 180K+ employees: Okta as the main IDP, a Teleport pilot for server access, and Terraform so app teams can onboard without waiting on a central queue.
Hire people who can think. Give them context. Get out of the way when they're shipping.
At HEB Digital. Not a roadmap dump, just where most of my time goes.
Server access via Teleport for Linux and Windows VMs. Owners decide who gets in. Roles: basic, elevated, short-lived admin. Sessions recorded. Hosts tagged by service, env, compliance.
Teleport, Clutch, CrowdStrike, OPA. Less “who is in AD,” more who can touch what host or API, and for how long. PCI MFA for privileged users is in this bucket too.
Service accounts, API clients, OAuth for APIs. Also thinking about AI agents. Same NHI problem, with more chatter and more blast radius if you get it wrong.
IAM in Terraform so app teams don’t wait on a central queue. Help-desk verification and day-2 tools for the stuff people used to email us about.
A few HEB programs with enough detail to be useful. Full timeline is under Experience.
Workforce login was split across OneLogin, on-prem ADFS, and other paths. Hard to govern, hard to support.
Cut over in waves with inventory and app owners. ~500 apps from OneLogin, 200+ from ADFS. Goal was one primary IDP without a multi-year outage story.
ResultOkta is the primary workforce IDP for 900+ apps.
Joiner/mover/leaver and access reviews were manual. Audits meant last-minute scrambles.
Stood up Okta IG for lifecycle, access requests, and certification campaigns so reviews and evidence live in one place.
ResultJML, requests, and cert campaigns run through Okta IG instead of spreadsheets and inbox threads.
Broad AD groups and domain joins for Linux access. Ownership was fuzzy; reviews and compliance proof were painful.
Teleport pilot first: inventory, enroll agents, owner access lists. Tighten only after it works. Exceptions written down.
ResultPilot live for Linux and Windows VMs, with owner-managed roles, session recording, and resource tags. Not a full estate flip overnight.
Every app onboard and a lot of day-2 changes hit a central IAM queue. Product teams waited; help desk emailed us constantly.
IAM config in Terraform. Self-service paths for onboarding. Verification tools for help desk so common checks don’t need an engineer.
ResultTeams can onboard without waiting on us for every change. Fewer “email IAM” tickets for routine work.
Most of the hard identity work now is not employees logging into apps. It’s services, API clients, and privileged paths. Soon it will also be agents acting on behalf of people or systems.
I don’t treat “AI agent identity” as a greenfield category. It’s non-human identity with worse PR: who is this, what can it do, how long does that last, who owns it, and can you show the trail later. Same questions we already ask for service accounts and break-glass admin. Volume and speed just punish lazy design faster.
On the ground that means Teleport/Clutch-style privileged access, OAuth for APIs, OPA where policy needs to be code, and not inventing a second identity program for agents that ignores the first one.
Most of my career has been identity: building it at Oracle, then modernizing it at HEB. The through-line is making access safer without making the business slower.
Multi-year IAM rebuild for a large retail workforce: one IDP, real governance, and a practical plan for privileged and machine access. Highlights below; deeper cuts under Selected work.
Spent a decade on Oracle’s multi-tenant Identity Cloud. Work covered SSO, federation, MFA, and customer identity for apps across the cloud portfolio.
Architecture work on loan servicing and investor reporting.
Consulting architect for enterprise clients.
WiQuest (intern, 2006): test automation for wireless devices and WHQL certification with Microsoft. Cognizant (2004–2005): support engineer on AMEX card services. Watched the network, fixed issues, hit the SLA.
IAM, eng leadership, or how identity programs land in a big org. Happy to talk.