{"id":3699326,"url":"https://alion.io/job/college-board-senior-workforce-iam-engineer","title":"Senior Workforce IAM Engineer","company":{"id":1753280,"name":"College Board","domain":"collegeboard.org","url":"https://alion.io/company/collegeboard-org","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":75,"open_postings":3,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":35,"computed_at":"2026-11-09T06:03:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["New York, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":153000,"max":166000,"currency":"USD","period":"year","gross":null,"usd_annual":166000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"AI Agents","optional":false},{"name":"CyberArk","optional":false},{"name":"Defense in Depth","optional":false},{"name":"IAM","optional":false},{"name":"Least Privilege","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Okta","optional":false},{"name":"PowerShell","optional":false},{"name":"Zero Trust","optional":false}],"status":"live","first_seen_at":"2026-11-03T18:58:44Z","employer_posted_date":"2026-11-03","last_verified_at":"2026-11-09T14:33:43Z","board_verified":true,"closed_at":null,"days_open":6,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":6},"description":"College Board - Technology - Workforce IAM\nLocation: This is a remote role. Candidates who live near CB offices have the option of being fully remote or hybrid (Tuesday and Wednesday in office). All CB employees are required to occasionally travel to meet in person for business purposes.\nRole Type: This is a full-time position\nAbout the Team\nThe Workforce Identity and Access Management (WIAM) team is the identity control plane for College Board's enterprise. The team owns the full workforce identity lifecycle, from onboarding and provisioning through access governance, certification, and offboarding, and operates the platforms that enforce authentication, authorization, and privileged access management across the organization.\nWIAM's work spans six capability pillars: identity onboarding, provisioning, authentication and authorization, credential management, governance and compliance, and identity offboarding. Each pillar has a named engineer accountable for its maturity, its roadmap, and the controls that run inside it. The team is the primary owner of College Board's enterprise IGA platform and PAM infrastructure, and it partners closely with Talent, ISGRC, and security peer teams to ensure identity services are reliable, auditable, and aligned to Zero Trust principles.\nThe team operates at the intersection of security rigor and user experience; the controls WIAM builds directly affect how every College Board employee accesses systems and data every day. As College Board's workforce has grown and its cloud and SaaS footprint has expanded, WIAM's scope has grown to match: centralizing more applications, automating more lifecycle actions, and governing an increasingly complex mix of human and non-human identities.\nAbout the Opportunity\nAs a Senior Engineer on the WIAM team, you are a hands-on identity engineer who owns the Governance and Compliance pillar and is accountable for it meeting its goals. The pillar covers the governance of access and identities in the IGA platform across human, service, and AI agent identities (currently in the building phase), including access reviews, security attestations, account reviews, least-privilege enforcement, segregation of duties, and account ownership and accountability. You ensure the access sent to reviewers is accurate and understandable, that reviews run on schedule, and that each produces clear, auditable evidence. While each review has an owner, you administer and facilitate how it is implemented, advising on feasibility, scheduling, notifications and communications, the evidence produced, and what the platform can give the reviewers. You are directly involved in how AI agents are integrated into the IGA platform, so they meet the same level of accountability through defined owners, lifecycle states, and reviewable access, while minimizing business impact when access is removed.\nYou also work as part of our broader WIAM team, where all engineers share the workload across our applications (AD, Entra ID, Okta OIG, CyberArk, and 1Password). That work includes access provisioning, identity management, setting up applications and integrations, building and maintaining automations (PowerShell, Okta Workflows, ADManager Plus, and other automation tools), maintaining vaults in CyberArk, and various other tasks. You bring a governance lens to all of it, asking what internal and external auditors will want from each process and making sure it is there. The controls you build shape how every College Board employee reaches the systems and data they need to serve students.\nIn this role, you will:\nFacilitate Certifications, Attestations, and Governance (35%)\nPlan and forecast the year's review cycle in Okta, including annual recurring reviews and new work, while balancing other teams' capacity against compliance and external audit deadlines\nDesign, configure, launch, monitor, and close access reviews, account reviews, and security attestations in Okta across human, service, and AI agent identities, scoped so reviewers can make considered decisions while reducing review fatigue\nBring new account types into the recurring review cycle as they come into scope\nRun the annual user access review cycle end to end, from scoping and reviewer assignment through remediation, closure, and delivery of the auditor reporting package against the use cases agreed upon with the audit owner\nFulfill evidence requests from internal College Board groups and external auditors by the agreed due date\nVerify requirements and review data before launch, and bring any issues you spot to the review owner\nMaintain the job guides and documentation that let another engineer run a review cycle correctly without you\nPartner with Security, Risk, Audit, Technology and business teams to translate security, compliance and technical requirements into workable identity controls\nKeep WIAM's practices aligned to College Board information security policy, tracking policy changes and flagging where team practice needs to move\nBuild and Enforce AI Governance (25%)\nIntegrate AI agent identities into the IGA platform as they come online, with defined owners, lifecycle states, and reviewable access\nDefine the ownership model for AI agents: who is accountable for an agent's access, and what happens when its purpose or owner changes\nBring AI agent identities under access review and least-privilege enforcement on the same cycle as human and service accounts\nGovern the access AI tools and agents hold to College Board systems and data: what each can reach, who approved it, how it is reviewed, and how to revoke it\nBuild and run the attestation flows for AI tools as the organization adopts them, reusing patterns rather than rebuilding per tool\nPartner with AI governance stakeholders and Risk Engineering so identity controls for agents are designed once and land in the right place\nBuild & Run Identity Services with Security in Mind (40%)\nWork alongside the team on day-to-day identity engineering, including onboarding, offboarding, and access requests, asking what internal and external auditors will want from each and making sure it is there\nDirect and review governance pillar work carried out by other engineers on the team, remaining accountable for the outcome\nEstablish and maintain account ownership and accountability across identity types: named owners and defined lifecycle states for human, service, and workload identities, extending to API identities as they come into scope\nEnforce least privilege with exceptions documented and tracked\nMonitor and correct any unintended changes between approved and actual entitlements across centralized applications\nAutomate enforcement and evidence with Okta Workflows and platform APIs\nMeasure the team's controls against recognized industry frameworks such as NIST, identify gaps, and propose how to close them\nReport on the enforcement of the pillar's controls with documented, traceable data\nAnalyze access and entitlement data to support troubleshooting, audits, and continuous improvement\nParticipate in the team's on-call rotation, responding to identity platform incidents and following established escalation procedures\nAbout You\nTo qualify for this role, you must have:\n5+ years of identity and access management and/or security engineering experience, including hands-on work with Active Directory, Entra ID, and Okta\nExperience designing and running access reviews, certifications, or attestation campaigns at scale, including scoping, reviewer assignment, remediation, and closure, and delivering the evidence to internal or external auditors\nWorking knowledge of policy and compliance frameworks such as NIST, and the judgment to translate framework guidance into practical control requirements\nHands-on production experience with Okta, especially Okta Identity Governance and Okta Workflows\nExperience with agentic AI governance: treating agents and workload identities as governed identities with owners, lifecycle states, and certifiable access\nSolid grounding in identity and access standards (SAML, OIDC, OAuth 2.0, SCIM) and in role- and attribute-based access control, SSO, MFA, and least privilege\nA secure-by-design mindset, with security built in as a system is designed, and a habit of checking a system’s actual state rather than what the configuration screen reported and of tracing a number back to the record it came from\nStrong written communication and the ability to see a control from the business and end-user perspective as well as the engineer's, including explain a control to someone who does not work in identity\nPreferred: Experience as an IT auditor or in a GRC function, testing controls over identities, provisioning, and access\nPreferred: Enterprise security certifications or recent coursework (e.g., CISSP, CISA, CRISC, Okta certifications, or similar)\nPreferred: A working understanding of defense in depth and how to implement layered controls in practice\nAll roles at College Board require:\nA passion for expanding educational and career opportunities and mission-driven work\nAuthorization to work in the United States for any employer\nCuriosity and enthusiasm for emerging technologies, with a willingness to experiment with and adopt new AI-driven solutions and comfort learning and applying new digital tools independently and proactively.\nClear and concise communication skills, written and verbal\nA learner's mindset and a commitment to growth: welcoming diverse perspectives, giving and receiving timely, respectful feedback, and continuously improving through iterative learning and user input\nA drive for impact and excellence: solving complex problems, making data-informed decisions, prioritizing what matters most, and continuously improving through learning, user input, and external benchmarking\nA collaborative and empathetic approach: working across differences, fostering trust, and contributing to a culture of shared success\nAbout Our Process\nApplication review will begin immediately and will continue until the position is filled. This role is expected to accept applications for a minimum of 5 business days.\nWhile the hiring process may vary, it generally includes: resume and application submission, recruiter phone/video screen, hiring manager interview, performance exercise such as live coding, a panel interview, a conversation with leadership and reference checks. \nWhat We Offer\nAt College Board, we offer more than just a paycheck-we provide a meaningful career, a supportive team, and a comprehensive package designed to help you thrive. We’re a self-sustaining nonprofit that believes in fair and competitive compensation, grounded in your qualifications, experience, impact, and the market.\nA Thoughtful Approach to Compensation\nThe hiring range for this role is $153,000 - $166,000.\nYour exact salary will depend on your location, experience, and how your background compares to others in similar roles at College Board.\nWe aim to make our best offer upfront-rooted in fairness, transparency, and market data.\nWe adjust salaries by location to ensure fairness, no matter where you live.\nYou’ll have open, transparent conversations about compensation, benefits, and what it’s like to work at College Board throughout your hiring process. Check out our careers page for more.","description_format":"text","description_chars":11299,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Skill Assessment","Nonprofits & Foundations"],"lifecycle":[{"event":"open","at":"2026-11-03T18:58:44Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 4 · green card filings: 3","filings_12m":4,"filings_prev_12m":7,"green_card_filings_12m":3,"median_offered_wage_usd":161071,"route":null,"cap_exempt":false,"checked_at":"2026-11-09T07:32:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":1}],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":5,"expected_fill_days":35,"reasons":["conf:1","velocity","win:early"],"computed_at":"2026-11-09T06:03:00Z"},"pay":{"stated_usd_annual":166000,"is_top_pay":true},"html_url":"https://alion.io/job/college-board-senior-workforce-iam-engineer","json_url":"https://alion.io/job/college-board-senior-workforce-iam-engineer.json","meta":{"generated_at":"2026-11-09T20:04:16Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6818,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-10T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1753280},"rest":"https://alion.io/mcp/rest/get_company?id=1753280"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcollege-board-senior-workforce-iam-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcollege-board-senior-workforce-iam-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcollege-board-senior-workforce-iam-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/college-board-senior-workforce-iam-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcollege-board-senior-workforce-iam-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3699326}},{"tool":"search_jobs","arguments":{"company":"collegeboard.org","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3699326},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}