Security Engineer

At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all.

IAM Secure Access Engineer

Today’s world is fueled by vast amounts of information. Data is more valuable than ever before. Protecting data and information systems is central to doing business, and everyone in EY Information Security has a critical role to play. Join a global team of professionals who collaborate to support the business by protecting information assets. Our Information Security professionals enable the organization to work securely and deliver secure products and services, as well as detect and respond to security events as they happen.

Within Information Security, we blend risk strategy, digital identity, cyber defense, application security and technology solutions across the security lifecycle. You will join a team of security-focused professionals dedicated to supporting, protecting and enabling the business through innovative and secure solutions that provide business value.

The opportunity

As part of the Identity and Access Management organization, the IAM Secure Access Engineer will design, configure, test and implement authentication, federation and authorization capabilities across enterprise, cloud and hybrid environments.

The role combines traditional IAM engineering fundamentals with delivery of new Secure Access initiatives across Microsoft Entra ID, Conditional Access, PingID, PingFederate, PingAccess, Okta, PlainID, multifactor authentication, passwordless authentication, workload identities, token protection and secrets or certificate-based authentication.

The engineer will work with Architecture, Product, Operations, application teams and vendors to translate requirements into secure, supportable solutions and move changes through design, build, test, production deployment and operational handover.

Your key responsibilities

Authentication, Federation & Access Engineering

• Design, configure and support authentication and federation integrations using SAML 2.0, OAuth 2.0, OpenID Connect and related standards.
• Implement and maintain MFA, single sign-on, passwordless authentication and risk-based access controls.
• Configure and troubleshoot PingID, PingFederate, PingAccess, Okta and Microsoft Entra ID integrations.
• Support onboarding and migration of applications to modern authentication patterns.
• Analyze authentication failures, policy conflicts, token issues and user access problems across integrated platforms.

Conditional Access & Identity Protection

• Implement and enhance Microsoft Entra Conditional Access policies, authentication strengths, authentication contexts and protected actions.
• Support Continuous Access Evaluation, token protection, sign-in risk controls and secure administrative access patterns.
• Assess policy impact, exclusions, break-glass requirements and deployment risks before production release.
• Use logs and platform telemetry to validate control effectiveness and investigate access issues.

Authorization, Workload Identity & Secrets

• Implement policy-based authorization using PlainID or comparable authorization platforms.
• Support role-based, attribute-based and policy-based access control patterns.
• Improve security for service principals, managed identities, application identities and other non-human identities.
• Support migration from shared secrets to managed identity, certificates or approved vault-based patterns.
• Coordinate certificate, key and secret lifecycle activities with PKI, vault and application teams.

Engineering Delivery & Operations

• Create technical designs, implementation plans, test cases, rollback plans and operational documentation.
• Raise and manage Change Requests and support production deployments through established controls.
• Automate repeatable administration and validation tasks using PowerShell, REST APIs or other approved scripting methods.
• Perform unit, integration, regression and security testing and support post-deployment validation.
• Participate in incident, problem, vulnerability remediation and continual improvement activities.

Skills and attributes for success

• Solid understanding of authentication, authorization, identity federation, MFA, SSO and Zero Trust principles.
• Hands-on experience with at least two of the following: Microsoft Entra ID, PingID, PingFederate, PingAccess, Okta or PlainID.
• Working knowledge of SAML, OAuth 2.0, OpenID Connect, JWT, SCIM, LDAP, Kerberos and RADIUS.
• Experience with Conditional Access, Identity Protection, workload identities or modern authentication controls.
• PowerShell or comparable scripting experience and the ability to work with REST APIs, JSON and certificates.
• Strong troubleshooting, documentation, testing and stakeholder communication skills.
• Understanding of secure software delivery, ITSM, Change Management and production support practices.

To qualify for the role you must have

• Degree in Computer Science, Information Technology, Cybersecurity or a related discipline, or equivalent practical experience.
• 2 to 5 years of experience in IAM, authentication engineering, access management, security engineering or enterprise platform support.
• Familiarity with CI/CD tools such as Azure DevOps, GitHub Actions, Jenkins, or GitLab CI/CD.
• Experience creating deployment pipelines and release automation.
• Basic containerization knowledge (Docker/Kubernetes preferred).
• Experience configuring or supporting enterprise authentication and access management solutions.
• Experience delivering controlled changes across development, test and production environments.
• Ability to analyze technical issues, document findings and work effectively with distributed teams.

Ideally, you’ll also have

• Experience with Microsoft Entra Conditional Access, Ping Identity products, Okta or PlainID.
• Knowledge of passwordless authentication, FIDO2, certificate-based authentication and PKI.
• Experience with CyberArk, Azure Key Vault or another enterprise secrets platform.
• Cloud platform knowledge in Azure and familiarity with CI/CD or infrastructure automation.
• Relevant Microsoft, Ping Identity, Okta, security or ITIL certification.

What we look for

We look for a hands-on engineer who combines sound IAM fundamentals with curiosity about emerging authentication and authorization controls. The successful candidate is structured, security-minded and comfortable collaborating across application, infrastructure, architecture and operations teams.

What we offer

As part of this role, you will work in a highly coordinated, globally diverse team with the opportunity and tools to grow, develop and drive your career forward. Here, you can combine global opportunity with flexible working. The benefits package focuses on physical, emotional, financial and social well-being. Your recruiter can explain the benefits available in your country.

• Continuous learning: You will develop the mindset and skills to navigate whatever comes next.
• Success as defined by you: We will provide the tools and flexibility so you can make a significant impact, your way.
• Transformative leadership: We will give you the insights, coaching and confidence to be the leader the world needs.
• Diverse and inclusive culture: You will be accepted for who you are and empowered to use your voice to help others find theirs.

EY | Building a better working world

EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets.

Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate.

Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today.