Senior Identity & Access Management (IAM) Engineer, IGA

IT accelerates the success of IDEXX employees and customers by providing scalable and innovative solutions and leadership. We are a global organization that supports all technology needed to deliver products and solutions to customers enabling them to focus on delivering high quality patient care. We strive to provide exceptional customer service and experience in the most efficient means possible, requiring alignment and cross-functional communication.

We are seeking a Senior IAM Engineer with direct, hands-on experience implementing and/or administering an enterprise Identity Governance and Administration (IGA) platform - such as SailPoint IdentityNow/IdentityIQ, Saviynt, Okta Identity Governance, or Microsoft Entra ID Governance. This is IDEXX's lead technical hire for a planned enterprise IGA implementation: IDEXX expects to select a platform (most likely SailPoint or Saviynt) by the end of 2026 and carry out an approximately year-long implementation to replace today's largely manual access provisioning with automated, governed identity lifecycle management.

This is a technical, hands-on engineering role where you have personally built, configured, scripted, migrated, or automated within an IGA platform.

In this role, you will be responsible for…

Identity Governance & Administration (IGA) - primary focus

• Personally implement, configure, and administer the enterprise IGA platform (SailPoint, Saviynt, or equivalent)
• Build and automate joiner, mover, and leaver (JML) workflows
• Configure access requests, approval workflows, and access certification/attestation processes
• Map entitlements and integrate applications into the IGA platform
• Design and implement role-based access control (RBAC) and access governance models
• Develop scripting and orchestration to automate provisioning, deprovisioning, and governance workflows (Java is particularly relevant within SailPoint/Saviynt environments; other vendor-specific scripting languages may also apply)
• Support audit, compliance, and regulatory reporting and attestation

Service Account, Managed Identity, and Workload Identity Governance

• Establish governance standards, inventory, ownership, and lifecycle processes for service accounts across on-prem and cloud
• Design and govern Azure Managed Identities and other cloud-native workload identities
• Reduce interactive use of service accounts; implement secure authentication and credential rotation
• Partner with application teams to eliminate embedded credentials/secrets
• Conduct periodic reviews to identify orphaned, stale, or over-privileged accounts

AI Agents & Non-Human Identity Management

• Define governance frameworks for AI agents, automation platforms, bots, APIs, and machine identities
• Establish identity creation, ownership, access review, and lifecycle controls for non-human identities
• Ensure visibility and traceability of non-human activity across enterprise systems

Automation & Engineering

• Build automation using PowerShell, Graph API, REST APIs, and cloud-native tooling
• Build integrations between the IGA platform, cloud providers, HR systems, ServiceNow, and enterprise applications

Security & Compliance

• Enforce least privilege and separation-of-duties controls
• Support security assessments, audits, and identity-related incident investigations
• Maintain alignment with NIST, ISO 27001, SOC 2, and CIS frameworks

What you'll need to succeed…

• Direct, hands-on experience personally implementing and/or administering an enterprise IGA platform (SailPoint IdentityNow/IdentityIQ, Saviynt, Okta Identity Governance, or Microsoft Entra ID Governance) - able to clearly describe individual technical ownership: what you configured, built, scripted, migrated, or automated

• For this role, it is good to have broad general IAM experience or advanced Microsoft Entra ID expertise, but required would be hands-on experience with IGA platform implementation, configuration, or automation experience.

• Experience developing provisioning/deprovisioning workflows, access request and approval processes, RBAC, entitlement mapping, and access certifications within an IGA platform
• Scripting and automation experience (Java is particularly valuable in SailPoint/Saviynt environments; other vendor-specific or general-purpose scripting also considered)
• 5+ years of experience in Identity and Access Management, Identity Governance, or Security Engineering
• Experience with Microsoft Entra ID, Active Directory, Azure, AWS IAM, or Google Cloud IAM
• Proficiency with PowerShell, REST APIs, and automation scripting

Preferred Qualifications

• Experience with Privileged Access Management (CyberArk, BeyondTrust, Delinea, Microsoft PAM, etc.)
• Experience governing AI agents, automation platforms, and machine identities
• Knowledge of cloud-native authentication methods and secrets management
• Experience integrating IAM/IGA solutions with HR, ITSM, and enterprise application ecosystems
• SailPoint, Saviynt, Microsoft, CISSP, Security+, or other relevant IAM/IGA certifications

Location: Preference for candidates within driving distance of IDEXX HQ in Westbrook, Maine (flexible hybrid - 8 days/month on-site). Also open to candidates in NH or MA who can come on-site less frequently. Recruiting is initially focused on ME, NH, and MA.

What you can expect from us:

• Base annual salary target: $100000 - $125000 (yes, we do have flexibility if needed)
• Opportunity for annual cash bonus
• Health / Dental / Vision Benefits Day-One
• 5% matching 401k
• Additional benefits including but not limited to financial support, pet insurance, mental health resources, volunteer paid days off, employee stock program, foundation donation matching, and much more!

Why IDEXX?

We’re proud of the work we do, because our work matters. An innovation leader in every industry we serve, we follow our Purpose and Guiding Principles to help pet owners worldwide keep their companion animals healthy and happy, to ensure safe drinking water for billions, and to help farmers protect livestock and poultry from diseases. We have customers in over 175 countries and a global workforce of over 10,000 talented people.

So, what does that mean for you? We enrich the livelihoods of our employees with a positive and respectful work culture that embraces challenges and encourages learning and discovery. At IDEXX, you will be supported by competitive compensation, incentives, and benefits while enjoying purposeful work that drives improvement.

Let’s pursue what matters together.

IDEXX values a diverse workforce and workplace and strongly encourages women, people of color, LGBTQ+ individuals, people with disabilities, members of ethnic minorities, foreign-born residents, and veterans to apply.

IDEXX is an equal opportunity employer. Applicants will not be discriminated against because of race, color, creed, sex, sexual orientation, gender identity or expression, age, religion, national origin, citizenship status, disability, ancestry, marital status, veteran status, medical condition, or any protected category prohibited by local, state, or federal laws.