{"id":3309526,"url":"https://alion.io/job/epam-systems-lead-ai-augmented-iam-security-engineer","title":"Lead AI-Augmented IAM Security Engineer","company":{"id":92,"name":"EPAM Systems","domain":"epam.com","url":"https://alion.io/company/epam-systems","size_band":"5000+","is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"HeadHunter","truth_index":{"grade":"D","score":45,"open_postings":58,"ghost_share":0.897,"stale_share":0,"repost_share":0.103,"time_to_fill_p50_days":44,"computed_at":"2026-10-28T05:59:10Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Riga, Latvia"],"countries":["LV"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":4200,"max":6000,"currency":"EUR","period":"month","gross":null,"usd_annual":80520},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agentic Workflows","optional":false},{"name":"AI Agents","optional":false},{"name":"Anomaly Detection","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Function Calling","optional":false},{"name":"GCP","optional":false},{"name":"Human-in-the-Loop","optional":false},{"name":"IAM","optional":false},{"name":"LDAP","optional":false},{"name":"Least Privilege","optional":false},{"name":"LLM","optional":false},{"name":"PowerShell","optional":false},{"name":"Prompt Engineering","optional":false},{"name":"Python","optional":false},{"name":"RAG","optional":false},{"name":"Rest API","optional":false},{"name":"Terraform","optional":false},{"name":"Active Directory","optional":true},{"name":"Auth0","optional":true},{"name":"AutoGen","optional":true},{"name":"AWS Bedrock","optional":true},{"name":"CI/CD","optional":true},{"name":"Copilot Studio","optional":true},{"name":"CyberArk","optional":true},{"name":"LangChain","optional":true},{"name":"Microsoft Entra ID","optional":true},{"name":"Okta","optional":true},{"name":"OpenAI","optional":true},{"name":"Ping Identity","optional":true},{"name":"Power Automate","optional":true},{"name":"SIEM","optional":true}],"status":"live","first_seen_at":"2026-10-17T01:31:17Z","employer_posted_date":null,"last_verified_at":"2026-10-17T01:31:17Z","board_verified":false,"closed_at":null,"days_open":11,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":11},"description":"Job Description\nWe are seeking a Lead AI-Augmented IAM Security Engineer to lead the hands-on implementation, configuration, automation and day-to-day operation of enterprise Identity and Access Management. This is a senior delivery-and-operations leadership role that works within the designs, standards, role models and policies set by IAM architects and security leadership, while guiding a team of engineers in execution. The focus is leading the building, configuration, scripting, running and troubleshooting of IAM, mentoring engineers, and ensuring operational excellence — not defining target-state architecture, role models or governance policy.\n\n_This position offers hybrid setup with the flexibility to work from any location in Latvia, whether it's your home or our office in Riga._\n\nLead a team of IAM engineers, providing technical direction, mentorship, code and configuration reviews, and ensuring quality, consistency and on-time delivery of IAM work\n\nPlan, prioritize and coordinate the team's workload across IAM projects, operational tasks, incidents and AI-automation initiatives, balancing delivery against operational stability\n\nImplement, configure and operate IAM solutions and controls based on architecture, standards and designs defined by IAM architects and security leadership, and ensure the team executes consistently against those standards\n\nOwn and oversee identity lifecycle (Joiner / Mover / Leaver) processes, including automated provisioning and deprovisioning across target systems\n\nDrive configuration of core IAM capabilities, including SSO, federation, MFA and passwordless authentication, conditional access, RBAC/ABAC role models and least-privilege access\n\nLead the development and deployment of IAM integrations and connectors with cloud platforms, SaaS applications, enterprise systems, directories, authoritative source systems, databases and APIs\n\nOversee access certification and review campaigns, entitlement clean-up and segregation-of-duties (SoD) rule configuration in line with access policies defined by architects and the business\n\nOperate and govern Privileged Access Management controls, including credential vaulting, secrets rotation, session management and just-in-time and just-enough access\n\nDefine and uphold standards for automation scripts, workflows and IAM tooling built using PowerShell, Python, REST APIs, SCIM, Terraform or similar technologies\n\nOversee IAM platform health monitoring, incident response, troubleshooting, patching, upgrades and configuration hardening, acting as a senior escalation point\n\nMaintain IAM logging, alerting and monitoring practices, and ensure backup and recovery procedures are executed according to defined runbooks and resilience requirements\n\nDrive the adoption of AI-assisted automations and agentic workflows that reduce manual effort across daily IAM operations, such as access request triage, entitlement analysis, anomaly detection, root-cause analysis, privileged access review support, compliance evidence collection and documentation generation\n\nLead the integration of AI agents and LLM-backed automations into IAM systems and operational pipelines, connecting models to internal tools, APIs, directories, ticketing and IAM platforms via function calling, SCIM, REST and webhooks\n\nEstablish and curate reusable prompts, structured-prompting patterns and prompt templates, and implement retrieval over IAM policies, role catalogs, runbooks and documentation (for example RAG) so AI assistants answer from current authoritative internal sources\n\nDefine and enforce output verification, human-in-the-loop approval gates and rollback paths in AI-assisted IAM workflows, so no AI-driven change reaches production access without review\n\nImplement and govern security and privacy controls for IAM AI usage, including least-privilege access for agents, secrets and credential handling, prompt-injection resistance, redaction of sensitive identity data and full auditability of AI-driven actions\n\nMonitor AI-assisted IAM automations in production, measure their accuracy and impact, continuously tune prompts, tools and workflows, and ensure the team produces operational documentation, runbooks and standard operating procedures while supporting audits and compliance evidence requests\n\nPartner with IAM architects, security leadership and stakeholders across engineering, infrastructure, security operations, compliance and business teams to translate strategy into executable delivery plans\n\nGrow the team through hiring input, onboarding, coaching, performance feedback and individual development planning\n\nRequirements\n\nBachelor's degree in Computer Science, Cybersecurity, Engineering or equivalent practical experience\n\n5+ years of hands-on experience implementing or operating Identity and Access Management solutions\n\n1+ years of leadership experience, such as tech lead, team lead, squad lead or engineering manager, with proven ability to direct, mentor and grow a team of engineers\n\nDemonstrated leadership skills, including the ability to set technical direction, prioritize workload, run reviews, resolve conflicts, drive accountability and represent the team to stakeholders\n\nStrong experience with at least one enterprise IAM, IGA, PAM or federation platform\n\nDeep understanding of IAM concepts, including identity lifecycle, authentication and authorization, SSO, federation, MFA, RBAC/ABAC, least privilege and privileged access\n\nSolid knowledge of common IAM protocols and standards such as SAML, OAuth 2.0 and OpenID Connect, alongside SCIM, LDAP and Kerberos\n\nProven experience configuring IAM controls, policies, connectors and access governance workflows at enterprise scale\n\nWorking knowledge of cloud IAM concepts across at least one major cloud platform such as Azure, AWS or GCP\n\nStrong scripting and automation experience using at least one of PowerShell, Python, Bash, REST APIs, SCIM or Terraform, with the ability to set coding and automation standards for the team\n\nDemonstrated capability to work closely with and influence developers, architects, infrastructure engineers, security operations, compliance teams and business stakeholders\n\nCompetency to define, follow, maintain and continuously improve IAM and security processes, leading change execution from tickets, runbooks and designs while escalating design-level questions appropriately\n\nPractical experience leading AI-assisted productivity and automation beyond basic chatbot usage, including building AI agents, automating repetitive IAM tasks, integrating LLMs with tools and documents, prompt engineering and using AI tools securely with awareness of sensitive identity data\n\nStrong communication and stakeholder-management skills, with the ability to explain IAM issues, technical decisions, trade-offs and remediation steps to both technical and non-technical audiences, including senior leadership\n\nNice to have\n\nFamiliarity with IAM platforms such as Microsoft Entra ID, Active Directory and Okta, alongside Ping Identity, ForgeRock, Auth0, SailPoint, Saviynt or CyberArk\n\nExperience with CIAM, B2B/B2C identity, customer identity, external identity or partner access scenarios, plus SIEM/SOAR integrations for IAM monitoring, alerting and automated response\n\nExperience with CI/CD-based IAM deployment, configuration-as-code and automated testing of IAM changes\n\nFamiliarity with AI/LLM platforms or frameworks such as Azure OpenAI, Amazon Bedrock and Microsoft Copilot Studio, alongside LangChain, AutoGen or Power Automate\n\nUnderstanding of AI security risks, including data leakage, prompt injection, excessive agency, insecure tool use, model governance and sensitive identity data exposure\n\nSC-300, Okta Certified Professional / Administrator / Consultant, SailPoint, Saviynt, CyberArk or Ping Identity certifications, CISSP, CISM, CISA, CCSK, CCSP, SSCP, AI-900 or AWS Certified AI Practitioner\n\nCompany offers\n\nEngineering Heritage: Best-in-class experts sharing a culture of engineering excellence and tackling complex engineering challenges for over 30 years.\n\nAdvanced Tech Stack: Innovative projects where you can apply or enhance your expertise in Cloud, Data, AI, and other emerging technologies.\n\nWorld-Class Clients: Work closely with 340+ of the Forbes Global 2000 on creating disruptive solutions that make a global impact.\n\nProfessional Growth: Exceptional support for career development with comprehensive resources for upskilling or reskilling in pioneering practices.\n\nGenAI Community: Strong AI competencies with 600+ experts across 55+ locations driving GenAI-enabled transformation journeys.\n\nEntrepreneurial Culture: If you're passionate and dedicated to improving business transformation, we provide the support you need to bring your ideas to life.\n\nHybrid Setup: The flexibility to work from any location in Latvia, whether it's your home or our office in Riga.\n\nOther Benefits: Additional vacation and trust days, private health insurance, Employee Stock Purchase Plan and more.","description_format":"text","description_chars":9017,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Health insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["IT Consulting & Digital Transformation","IT Outsourcing & Dedicated Teams","Custom Software Development"],"lifecycle":[{"event":"open","at":"2026-10-27T02:43:38Z"}],"visa":[],"liveness":{"score":62,"band":"ok","label":"Likely open","p_open":1,"p_active":0.625,"p_room":1,"age_days":11,"expected_fill_days":44,"reasons":["seen:11","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-10-28T05:59:10Z"},"pay":{"stated_usd_annual":80520,"is_top_pay":false},"html_url":"https://alion.io/job/epam-systems-lead-ai-augmented-iam-security-engineer","json_url":"https://alion.io/job/epam-systems-lead-ai-augmented-iam-security-engineer.json","meta":{"generated_at":"2026-10-28T12:12:38Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":16067,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-29T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":92},"rest":"https://alion.io/mcp/rest/get_company?id=92"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fepam-systems-lead-ai-augmented-iam-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fepam-systems-lead-ai-augmented-iam-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fepam-systems-lead-ai-augmented-iam-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/epam-systems-lead-ai-augmented-iam-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fepam-systems-lead-ai-augmented-iam-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3309526}},{"tool":"search_jobs","arguments":{"company":"epam.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3309526},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}