{"id":3311888,"url":"https://alion.io/job/cardinal-health-senior-engineer-workforce-iam","title":"Senior Engineer, Workforce IAM","company":{"id":1779154,"name":"Cardinal Health","domain":"cardinalhealth.com","url":"https://alion.io/company/cardinalhealth-com","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":89,"open_postings":27,"ghost_share":0,"stale_share":0.444,"repost_share":0,"time_to_fill_p50_days":26,"computed_at":"2026-11-06T05:58:05Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":84000,"max_usd":151000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":390},"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Agile","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CyberArk","optional":false},{"name":"GCP","optional":false},{"name":"GDPR","optional":false},{"name":"HashiCorp Vault","optional":false},{"name":"HIPAA","optional":false},{"name":"IAM","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Okta","optional":false},{"name":"Oracle ERP","optional":false},{"name":"Rest API","optional":false},{"name":"Self-Healing","optional":false},{"name":"SOAP","optional":false}],"status":"live","first_seen_at":"2026-10-26T00:00:00Z","employer_posted_date":"2026-10-26","last_verified_at":"2026-11-06T09:56:34Z","board_verified":true,"closed_at":null,"days_open":11,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":11},"description":"Cardinal Health, Inc. (NYSE: CAH) is a global healthcare services and products company. We provide customized solutions for hospitals, healthcare systems, pharmacies, ambulatory surgery centers, clinical laboratories, physician offices and patients in the home. We are a distributor of pharmaceuticals and specialty products; a global manufacturer and distributor of medical and laboratory products; an operator of nuclear pharmacies and manufacturing facilities; and a provider of performance and data solutions. Working to be healthcare’s most trusted partner, our customer-centric focus drives continuous improvement and leads to innovative solutions that improve the lives of people every day. With approximately 50,000 employees worldwide, Cardinal Health ranks among the top fifteen in the Fortune 500.\nDepartment Overview:\nInformation Security and Risk develops, implements, and enforces security controls to protect the organization's technology assets from intentional or inadvertent modification, disclosure, or destruction. The function of this job family is to ensure secure, authorized, and compliant access to the organization's data, systems, and physical resources. It focuses on defining, creating, managing, and governing digital identities and their associated access privileges to protect the enterprise from security breaches, insider threats, and regulatory non-compliance\nWe are seeking a highly skilled and experienced Identity and Access Management (IAM) Senior Engineer to join our Workforce Identity team. In this role, you will architect, scale, and modernize the systems that secure over 50,000 global employees, contractors, and critical distribution operations. You will drive identity strategy across a hyper-scale, hybrid multi-cloud environment, spearhead rapid M&A integrations, champion Zero Standing Privilege (ZSP), and architect next-generation non-human and frontline identity solutions.\nResponsibilities:\nM&A Architecture & Federation Strategy\nArchitect repeatable, high-velocity identity blueprints for Mergers, Acquisitions, and Divestitures, reducing subsidiary integration timeframes from months to weeks.\nLead cross-domain identity consolidation across disparate identity providers (Okta, Entra ID, Ping) and divergent enterprise directories.\nDesign robust cross-cloud federation, B2B collaboration frameworks, and tenant boundary governance.\nLead IAM technical workstreams for Mergers, Acquisitions, and Divestitures. Consolidate disparate identity providers (IdPs) into a unified enterprise SSO platform. Design and execute cross-domain authentication and federation strategies.\nLead IAM discovery, identity migration, and system consolidation for newly acquired business entities.\nDirect experience migrating users, mapping attributes, and consolidating divergent directories.\nArchitecture influence and decision-making\nDefine enterprise IAM architecture standards: Formulate technical standards, architectural patterns, and reference blueprints for enterprise SSO, Identity Governance and Administration (IGA), and directory services.\nTechnical authority and vendor SoW evaluation: Act as a critical architectural authority to evaluate third-party integration patterns, challenge vendor Statements of Work (SoWs) for high-complexity migrations (e.g., ADFS to Okta) and establish technical decommissioning strategies for legacy identity platforms.\nHybrid and multi-cloud IAM\nArchitect hybrid and multi-cloud IAM bridges: Design, govern, and scale secure identity bridges linking legacy on-premises infrastructure (Active Directory, ADFS) with hyper-scale multi-cloud environments (GCP, AWS, Azure/Entra ID) and SaaS ecosystems (Okta, SailPoint).\nPrivileged Access and JIT governance: Define and architect robust Zero Standing Privilege (ZSP) and Just-In-Time (JIT) access control patterns using Privileged Access Management (PAM - CyberArk, HashiCorp Vault) and Cloud Infrastructure Entitlement Management (CIEM) to reduce the on-premises and cloud attack surface.\nEmerging tech trends and business growth\nModern Identity roadmaps (NHIM and ISPM): Research, evaluate, and integrate emerging industry trends-such as Non-Human Identity Management (NHIM), Identity Security Posture Management (ISPM), and agentic/AI security controls-into the long-term IAM roadmap.\nAgile Identity for business scale: Ensure identity systems are agile and scalable enough to support Cardinal Health's rapid business expansion, M&A pipeline, and digital healthcare operations without introducing friction\nIGA Integrations\nDesign repeatable, high-velocity identity blueprints for Mergers, Acquisitions, and Divestitures, reducing subsidiary integration timeframes from months to weeks.\nLead cross-domain identity consolidation across disparate identity providers (Okta, Entra ID, Ping) and divergent enterprise directories.\nDesign robust cross-cloud federation, B2B collaboration frameworks, and tenant boundary governance\nAuthoritative Source Integration: Design and implement seamless integrations with HRMS platforms (e.g., Workday, SuccessFactors, PeopleSoft) to drive the identity lifecycle.\nFormulate policy-driven access models (RBAC/PBAC) and automated Segregation of Duties (SoD) frameworks meeting strict SOX ITGC, HIPAA, and GDPR requirements.\nArchitect specialized authentication solutions (contactless RFID badge tap-and-go, biometric FIDO2 smart cards, shared kiosk sessions) supporting nuclear pharmacies, manufacturing plants, and distribution centers.\nDesign \"Single Pane of Glass\" self-service capabilities for people leaders to proactively monitor and right-size direct report access.\nPartner with IAM Engineering to establish self-healing provisioning patterns achieving 99.999% core availability\nApplication Onboarding: Design, develop, and configure SailPoint connectors for Active Directory (AD), JDBC, and Web Services (REST/SOAP).\nAutomated Provisioning: Configure and maintain Birthright provisioning to ensure immediate, policy-driven access for joiners on day one.\nProcess Automation: Automate lifecycle events (Joiner, Mover, Leaver) and request-based provisioning workflows.\nExpand Cloud Infrastructure Entitlement Management (CIEM) to continuously discover and eliminate over-privileged assignments\nAutomation and Workflows\nDevelop automated workflows to streamline user onboarding, transitions, and offboarding.\nBuild API-driven automations to reduce manual provisioning overhead.\nImplement infrastructure-as-code (IaC) principles for IAM configurations.\nSecurity Policy and Compliance\nEnsure IAM systems and processes comply with regulatory requirements (e.g., GDPR, HIPAA, SOX) and internal security policies, providing auditable records of access activities. Protect against data breaches by ensuring only authorized personnel can access sensitive information.\n Solution Design & Implementation: Design, implement, and maintain IAM solutions including Single Sign-On (SSO), Identity life cycle management, IGA and PAM.\nCollaboration & Communication: Coordinate cross-functional teams, including Information Security, IT Operations, HR, and Application Development, to ensure effective IAM implementation and seamless integration with business processes. Communicate complex security concepts to technical and non-technical stakeholders.\nDocumentation & Best Practices: Develop, review, and maintain comprehensive technical documentation, including architecture diagrams, configuration guides, and operational procedures. Stay up-to-date with IAM best practices, regulatory requirements, and security trends.\nQualifications:\nEducation: Bachelor's degree in Computer Science, Information Technology, Information Security, or a related field, or equivalent practical experience.\nExperience: 10+ years in Information Security and Identity Management, with at least 5+ years operating as a Lead or Principal Enterprise IAM Architect within a Fortune 500 or hyper-scale enterprise preferred.\n Technical Expertise:Deep theoretical and practical command of OAuth 2.0, OpenID Connect (OIDC), SAML 2.0, SCIM 2.0, FIDO2/WebAuthn, and Kerberos.\nProven architectural authority across enterprise IdPs (Microsoft Entra ID, Okta), IGA platforms (SailPoint IdentityIQ / Identity Security Cloud), and PAM solutions (CyberArk, HashiCorp Vault).\nDemonstrated success leading identity discovery, tenant consolidation, and domain migration workstreams across complex, multi-entity corporate structures.\nComprehensive familiarity with SOX 404 ITGC controls, HIPAA Security Rule, and international data sovereignty frameworks.\nExceptional executive communication, stakeholder diplomacy, and ability to translate cryptographic/identity concepts into clear business risk decisions .\nAbility to manage multiple priorities and meet tight deadlines in a fast-paced M&A environment.\nAdaptability to stay ahead of evolving IAM technologies and security threats.\n\nWhat is expected of you and others at this level\nApplies advanced knowledge and understanding of concepts, principles, and technical capabilities to manage a wide variety of projects\nParticipates in the development of policies and procedures to achieve specific goals\nRecommends new practices, processes, metrics, or models\nWorks on or may lead complex projects of large scope\nProjects may have significant and long-term impact\nProvides solutions which may set precedent\nIndependently determines method for completion of new projects\nReceives guidance on overall project objectives\nActs as a mentor to less experienced colleagues\nAnticipated salary range: $125,300 - $178,900\nBonus eligible: Yes\nBenefits: Cardinal Health offers a wide variety of benefits and programs to support health and well-being.\nMedical, dental and vision coverage\nPaid time off plan\nHealth savings account (HSA)\n401k savings plan\nAccess to wages before pay day with myFlexPay\nFlexible spending accounts (FSAs)\nShort- and long-term disability coverage\nWork-Life resources\nPaid parental leave\nHealthy lifestyle programs\nApplication window anticipated to close: 11/23/2026 *if interested in opportunity, please submit application as soon as possible.\nThe salary range listed is an estimate. Pay at Cardinal Health is determined by multiple factors including, but not limited to, a candidate’s geographical location, relevant education, experience and skills and an evaluation of internal pay equity.\nCardinal Health supports an inclusive workplace that values diversity of thought, experience and background. We celebrate the power of our differences to create better solutions for our customers by ensuring employees can be their authentic selves each day. Cardinal Health is an Equal Opportunity employer. All qualified applicants will receive consideration for employment without regard to race, religion, color, national origin, ancestry, age, physical or mental disability, sex, sexual orientation, gender identity/expression, pregnancy, veteran status, marital status, creed, status with regard to public assistance, genetic status or any other status protected by federal, state or local law.\nTo read and review this privacy notice click here","description_format":"text","description_chars":11115,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["401k plan","Equity","Parental leave"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Health Care","Pharmacies","Pharmaceutical Distribution","Medical Equipment Distribution"],"lifecycle":[{"event":"open","at":"2026-10-27T03:40:56Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 169 · green card filings: 45","filings_12m":169,"filings_prev_12m":105,"green_card_filings_12m":45,"median_offered_wage_usd":125654,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":14}],"liveness":{"score":74,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.827,"p_room":0.9,"age_days":11,"expected_fill_days":26,"reasons":["conf:1","velocity","win:mid","comp:brand"],"computed_at":"2026-11-06T05:58:05Z"},"pay":null,"html_url":"https://alion.io/job/cardinal-health-senior-engineer-workforce-iam","json_url":"https://alion.io/job/cardinal-health-senior-engineer-workforce-iam.json","meta":{"generated_at":"2026-11-06T14:02:36Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":25903,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-07T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1779154},"rest":"https://alion.io/mcp/rest/get_company?id=1779154"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcardinal-health-senior-engineer-workforce-iam"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcardinal-health-senior-engineer-workforce-iam"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcardinal-health-senior-engineer-workforce-iam"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cardinal-health-senior-engineer-workforce-iam\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcardinal-health-senior-engineer-workforce-iam"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3311888}},{"tool":"search_jobs","arguments":{"company":"cardinalhealth.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3311888},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}