{"id":3970196,"url":"https://alion.io/job/kidde-senior-iam-engineer","title":"Senior IAM Engineer","company":{"id":712970,"name":"Kidde","domain":"kidde.com","url":"https://alion.io/company/kidde-2","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Dayforce","truth_index":{"grade":"B","score":78,"open_postings":15,"ghost_share":0,"stale_share":0.867,"repost_share":0,"time_to_fill_p50_days":44,"computed_at":"2026-11-09T06:03:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["São Paulo, Brazil"],"countries":["BR"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Auth0","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Okta","optional":false},{"name":"PKI","optional":false},{"name":"PowerShell","optional":false},{"name":"Rest API","optional":false}],"status":"live","first_seen_at":"2026-11-09T03:00:00Z","employer_posted_date":"2026-11-09","last_verified_at":"2026-11-09T15:45:59Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Role Purpose\nThis role exists to serve as KGS’s senior in-house engineer for enterprise identity platforms, including Saviynt Identity Governance & Administration (IGA), Saviynt Privileged Access Management (PAM), single sign-on (SSO), and Customer Identity & Access Management (CIAM). The role owns Level 2 through Level 4 engineering work across design, configuration, integration, automation, and complex escalation, while the managed service provider continues to deliver Level 1 operations.\nBased in Brazil, the role extends IAM coverage across the Americas and EMEA and provides trained backup for Active Directory, Microsoft Entra ID, and Microsoft 365 identity services. The role partners with the Senior Manager, Identity & Cloud Security, GRC, Infrastructure & Operations, HR, application owners, and service providers to strengthen identity governance, reduce operational risk, and improve automation and service resilience.\nRole Accountabilities\nThis outlines the typical and expected accountabilities for this role:\nIdentity Governance & Administration: Onboard applications into Saviynt; build and maintain connectors, forms, workflows, request catalogs, and joiner-mover-leaver rules; and resolve synchronization issues between Dayforce and downstream systems.\nAccess Certifications: Design and run User Access Review (UAR) and Privileged Access Review (PAR) campaigns, including advanced configuration for SOX-scoped and critical applications, and produce audit-ready evidence.\nPrivileged Access Management: Administer the privileged-access vault and own service-account discovery, server onboarding, credential governance, AWS and Azure landing-zone integration, onboarding automation, and orphaned-account remediation.\nCustomer & External Identity: Design, build, and operate CIAM capabilities for customers, partners, and other external users, including registration, authentication, federation, consent, and lifecycle governance.\nSSO & Modern Authentication: Onboard applications using SAML, OIDC, OAuth, and related provisioning standards; support retirement of legacy authentication; and apply established SSO governance and reporting standards.\nAutomation & Reporting: Automate identity lifecycle and operational tasks and develop dashboards and metrics using PowerShell, Microsoft Graph, REST APIs, and related tooling.\nIdentity Platform Coverage: Serve as trained backup for Active Directory and Microsoft Entra ID capabilities, including Conditional Access, PIM, Group Policy, PKI, and Microsoft 365 identity controls.\nIncident Response & On-Call: Participate in the identity on-call rotation and lead triage, root-cause analysis, and remediation for complex identity incidents.\nOperations & Managed Services: Provide Level 2–Level 4 identity support, act as the escalation point for the managed service provider, review Level 1 service quality, and maintain runbooks and knowledge transfer to reduce key-person dependency.\nRisk, Audit & Continuous Improvement: Support SOX, ISO 27001, and NIST-aligned controls; remediate audit findings; maintain control evidence; and identify opportunities to improve reliability, security, self-service, and user experience.\nRole Competencies\nCore Competencies\nThese are critical and fundamental to perform the role:\nIdentity engineering: Deep hands-on expertise in IGA, PAM, SSO, federation, authentication, and identity lifecycle management at enterprise scale.\nTechnical problem solving: Diagnosing complex integrations, synchronization failures, access issues, and platform defects through structured analysis and root-cause remediation.\nAutomation and improvement: Using scripting, APIs, reusable patterns, and self-service to reduce manual effort and improve control consistency.\nRisk and compliance: Translating SOX, ISO 27001, and NIST-aligned requirements into sustainable identity controls and audit-ready evidence.\nOperational ownership: Managing escalations, incidents, changes, documentation, and service-provider handoffs with urgency and accountability.\nCollaboration and communication: Working effectively with global technical teams, business stakeholders, auditors, and external partners in English and Portuguese.\nQualifications (Education, Experience, Technical Knowledge)\nKey qualifications relevant to this role:\nBachelor’s degree in Computer Science, Information Systems, or a related field, or equivalent experience.\n8+ years of Identity & Access Management experience, including 3+ years of hands-on engineering experience with Saviynt or a comparable IGA/PAM platform.\nDemonstrable experience building connectors, workflows, request processes, and application onboarding in an enterprise IGA platform.\nHands-on CIAM experience with Microsoft Entra External ID, Azure AD B2C, Okta/Auth0, Ping, or a comparable platform.\nStrong PAM knowledge, including vaulting, credential rotation, service-account governance, privileged onboarding, and session management.\nWorking knowledge of Microsoft Entra ID, Active Directory, Conditional Access, PIM, Group Policy, PKI, and SAML/OIDC/OAuth protocols.\nAutomation skills using PowerShell, REST APIs, Microsoft Graph, or comparable technologies.\nExperience supporting SOX and/or ISO 27001 audits and producing control evidence.\nFluency in English and Portuguese and willingness to participate in identity incident on-call support.\nSaviynt IGA/PAM certification and Microsoft SC-300 are preferred; CISSP, CISM, or CIAM-related certifications are beneficial.\nExperience working with global teams, managed service providers, and distributed stakeholders is preferred.","description_format":"text","description_chars":5590,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[{"language":"Portuguese","level":"Advanced (C1)","optional":false},{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":[],"hiring_locations":[{"name":"Brazil","iso":"BR","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Locks, Safes & Home Security Products"],"lifecycle":[{"event":"open","at":"2026-11-09T15:45:59Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":45,"reasons":["conf:0","win:early","comp:brand"],"computed_at":"2026-11-09T16:45:43Z"},"pay":null,"html_url":"https://alion.io/job/kidde-senior-iam-engineer","json_url":"https://alion.io/job/kidde-senior-iam-engineer.json","meta":{"generated_at":"2026-11-09T16:45:43Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":24616,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-10T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":712970},"rest":"https://alion.io/mcp/rest/get_company?id=712970"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fkidde-senior-iam-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fkidde-senior-iam-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fkidde-senior-iam-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/kidde-senior-iam-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fkidde-senior-iam-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3970196}},{"tool":"search_jobs","arguments":{"company":"kidde.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3970196},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}