Senior IAM Engineer
Confirmed on the employer's own hiring board on Nov 9, 2026. First seen by Alion on Nov 9, 2026. Kidde scores B on the Alion truth index.
Role Purpose
This role exists to serve as KGS’s senior in-house engineer for enterprise identity platforms, including Saviynt Identity Governance & Administration (IGA), Saviynt Privileged Access Management (PAM), single sign-on (SSO), and Customer Identity & Access Management (CIAM). The role owns Level 2 through Level 4 engineering work across design, configuration, integration, automation, and complex escalation, while the managed service provider continues to deliver Level 1 operations.
Based in Brazil, the role extends IAM coverage across the Americas and EMEA and provides trained backup for Active Directory, Microsoft Entra ID, and Microsoft 365 identity services. The role partners with the Senior Manager, Identity & Cloud Security, GRC, Infrastructure & Operations, HR, application owners, and service providers to strengthen identity governance, reduce operational risk, and improve automation and service resilience.
Role Accountabilities
This outlines the typical and expected accountabilities for this role:
Identity Governance & Administration: Onboard applications into Saviynt; build and maintain connectors, forms, workflows, request catalogs, and joiner-mover-leaver rules; and resolve synchronization issues between Dayforce and downstream systems.
Access Certifications: Design and run User Access Review (UAR) and Privileged Access Review (PAR) campaigns, including advanced configuration for SOX-scoped and critical applications, and produce audit-ready evidence.
Privileged Access Management: Administer the privileged-access vault and own service-account discovery, server onboarding, credential governance, AWS and Azure landing-zone integration, onboarding automation, and orphaned-account remediation.
Customer & External Identity: Design, build, and operate CIAM capabilities for customers, partners, and other external users, including registration, authentication, federation, consent, and lifecycle governance.
SSO & Modern Authentication: Onboard applications using SAML, OIDC, OAuth, and related provisioning standards; support retirement of legacy authentication; and apply established SSO governance and reporting standards.
Automation & Reporting: Automate identity lifecycle and operational tasks and develop dashboards and metrics using PowerShell, Microsoft Graph, REST APIs, and related tooling.
Identity Platform Coverage: Serve as trained backup for Active Directory and Microsoft Entra ID capabilities, including Conditional Access, PIM, Group Policy, PKI, and Microsoft 365 identity controls.
Incident Response & On-Call: Participate in the identity on-call rotation and lead triage, root-cause analysis, and remediation for complex identity incidents.
Operations & Managed Services: Provide Level 2–Level 4 identity support, act as the escalation point for the managed service provider, review Level 1 service quality, and maintain runbooks and knowledge transfer to reduce key-person dependency.
Risk, Audit & Continuous Improvement: Support SOX, ISO 27001, and NIST-aligned controls; remediate audit findings; maintain control evidence; and identify opportunities to improve reliability, security, self-service, and user experience.
Role Competencies
Core Competencies
These are critical and fundamental to perform the role:
Identity engineering: Deep hands-on expertise in IGA, PAM, SSO, federation, authentication, and identity lifecycle management at enterprise scale.
Technical problem solving: Diagnosing complex integrations, synchronization failures, access issues, and platform defects through structured analysis and root-cause remediation.
Automation and improvement: Using scripting, APIs, reusable patterns, and self-service to reduce manual effort and improve control consistency.
Risk and compliance: Translating SOX, ISO 27001, and NIST-aligned requirements into sustainable identity controls and audit-ready evidence.
Operational ownership: Managing escalations, incidents, changes, documentation, and service-provider handoffs with urgency and accountability.
Collaboration and communication: Working effectively with global technical teams, business stakeholders, auditors, and external partners in English and Portuguese.
Qualifications (Education, Experience, Technical Knowledge)
Key qualifications relevant to this role:
Bachelor’s degree in Computer Science, Information Systems, or a related field, or equivalent experience.
8+ years of Identity & Access Management experience, including 3+ years of hands-on engineering experience with Saviynt or a comparable IGA/PAM platform.
Demonstrable experience building connectors, workflows, request processes, and application onboarding in an enterprise IGA platform.
Hands-on CIAM experience with Microsoft Entra External ID, Azure AD B2C, Okta/Auth0, Ping, or a comparable platform.
Strong PAM knowledge, including vaulting, credential rotation, service-account governance, privileged onboarding, and session management.
Working knowledge of Microsoft Entra ID, Active Directory, Conditional Access, PIM, Group Policy, PKI, and SAML/OIDC/OAuth protocols.
Automation skills using PowerShell, REST APIs, Microsoft Graph, or comparable technologies.
Experience supporting SOX and/or ISO 27001 audits and producing control evidence.
Fluency in English and Portuguese and willingness to participate in identity incident on-call support.
Saviynt IGA/PAM certification and Microsoft SC-300 are preferred; CISSP, CISM, or CIAM-related certifications are beneficial.
Experience working with global teams, managed service providers, and distributed stakeholders is preferred.