{"id":4285973,"url":"https://alion.io/job/life-time-senior-identity-access-management-engineer","title":"Senior Identity & Access Management Engineer","company":{"id":1811405,"name":"Life Time","domain":"lifetime.life","url":"https://alion.io/company/lifetime-life","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Schema","truth_index":{"grade":"B","score":76,"open_postings":462,"ghost_share":0.281,"stale_share":0.009,"repost_share":0.483,"time_to_fill_p50_days":34,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Chanhassen, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Azure","optional":false},{"name":"CyberArk","optional":false},{"name":"DLP","optional":false},{"name":"HIPAA","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"LDAP","optional":false},{"name":"Least Privilege","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"Windows","optional":false},{"name":"ITSM","optional":true},{"name":"Jira","optional":true},{"name":"Ping Identity","optional":true},{"name":"ServiceNow","optional":true},{"name":"Zero Trust","optional":true}],"status":"live","first_seen_at":"2026-11-13T21:49:39Z","employer_posted_date":"2026-11-13","last_verified_at":"2026-11-13T21:49:39Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"The Life Time Technology team is at the forefront of the evolution of Life Time into a digital-first company, transforming existing experiences and creating brand new ones both online and in our clubs. If you enjoy a fast-paced environment with the latest technologies and have a passion for health and fitness - we should meet. Work is a team effort, and we are a highly motivated, highly collaborative team; we always win or lose together. We invest in our team members and ensure they have the tools and opportunities to learn, grow and thrive. We offer an incredible benefits package, generous club discounts, and a fully subsidized Signature Life Time Membership. Want to Love Your Life? Join our team.Position Summary\nWe are seeking a skilled Identity & Access Management (IAM) Engineer to join our Information Technology Team. In this role, you will be responsible for designing, implementing, and maintaining enterprise identity and access management solutions that protect our organization's critical resources while enabling seamless user experiences.\nYou will work across a modern IAM stack including cloud identity platforms, privileged access management, directory services, and email security with PingOne, PingOne DaVinci, SailPoint Identity Cloud, CyberArk Privilege Cloud, Microsoft Active Directory, Exchange On-Premises, Mimecast, Microsoft 365, and OAuth 2.0 On-Behalf-Of (OBO) token flows for API-to-API authentication.- partnering closely with IT, Security, and Business stakeholders to ensure robust, scalable, and compliant access controls.\nJob Duties and Responsibilities\nIdentity Platform Administration (SailPoint / PingOne)\nDesign, configure, and maintain PingOne identity platform including SSO, MFA, and user lifecycle management\nBuild and manage identity orchestration workflows using PingOne DaVinci, including policy-driven authentication flows and integration connectors\nIntegrate applications via SAML 2.0, OIDC, and OAuth 2.0 with PingOne as the Identity Provider (IdP).\nAdminister and extend SailPoint Identity Cloud for identity governance, access certifications, role management, and automated provisioning/deprovisioning\nDefine and enforce access governance policies, separation of duties (SoD) rules, and recertification campaigns across enterprise applications.\nDevelop connectors, workflows, rules, and reports within SailPoint to meet compliance and audit requirements (SOX, HIPAA, PCI.).\nMaintain identity data integrity across connected systems and authoritative sources\nPrivileged Access Management (CyberArk Privilege Cloud)\nAdminister CyberArk Privilege Cloud to manage, monitor, and audit privileged account access\nOnboard privileged accounts (Windows, Linux, network devices, databases, cloud service accounts) and enforce least privilege principles\nDevelop and maintain CyberArk platform policies, master policies, and credential rotation schedules.\nRespond to PAM-related incidents and conduct periodic privileged access reviews\nIntegrate CyberArk with enterprise systems and automate credential rotation workflows\nDirectory Services and Active Directory\nManage and maintain Microsoft Active Directory infrastructure including forests, domains, OUs, GPOs, and trusts\nSupport AD health monitoring, replication, and performance tuning\nMaintain and optimize Group Policy Objects (GPOs) for security hardening and compliance\nExecute AD lifecycle management: user and group provisioning, access reviews, and cleanup\nEmail and Messaging Security (Exchange On-Premise / Mimecast)\nAdminister Microsoft Exchange On-Premises environments including mailbox management, transport rules, and connectors\nManage Mimecast email security including policy configuration, threat protection, and continuity services\nOversee Microsoft 365 messaging services including Exchange Online, Teams, and related workloads\nRespond to email security incidents including phishing, spoofing, and mail flow issues\nMicrosoft 365 and Cloud Identity\nAdminister Microsoft 365 tenant including licensing, conditional access, and security baselines\nConfigure and maintain Azure AD / Entra ID integration with on-premises AD via hybrid join and sync\nImplement and manage M365 security features including MFA enforcement, Privileged Identity Management (PIM), and compliance policies\nCollaborate on M365 governance, data loss prevention (DLP), and access control policies\nAPI Authentication & OAuth 2.0 On-Behalf-Of (OBO) Flows\nAdminister Microsoft 365 tenant including licensing, conditional access, and security baselines\nDesign and implement API-to-API authentication patterns using the OAuth 2.0 On-Behalf-Of (OBO) token flow - enabling services to call downstream APIs on behalf of authenticated users.\nRegister and manage app registrations, service principals, API permissions, and consent frameworks in Microsoft Entra ID and PingOne.\nCollaborate with development teams to review token scopes, audience validation, token lifetime policies, and secure token storage practices.\nImplement and enforce token validation, refresh token rotation, and mTLS certificate-bound token strategies where applicable.\nDocument OBO flow architectures and provide guidance on secure service mesh and microservices identity patterns.\nSecurity, Compliance and Governance\nConduct periodic access certification campaigns and remediate inappropriate entitlements\nEnsure IAM solutions comply with regulatory frameworks such as SOX, HIPAA, NIST, and ISO 27001\nDocument IAM processes, runbooks, and architecture decisions\nParticipate in security audits and support evidence collection for access-related controls\nProactively identify and remediate identity-related risks and vulnerabilities\nIntegration and Automation\nDevelop and maintain integrations between IAM platforms using REST APIs, SCIM, LDAP, and SAML\nBuild automation scripts (PowerShell, Python, or similar) to streamline IAM operations\nCollaborate with application teams to onboard new applications to SSO and provisioning workflows\nPosition Requirements\n7+ years of experience in Identity & Access Management or related Information Security roles\nHands-on experience with PingOne and/or PingOne DaVinci (or comparable CIAM/IDP platform)\nDemonstrated experience with SailPoint IIQ or IdentityNow (governance, provisioning, certifications)\nPractical knowledge of CyberArk Privilege Cloud or CyberArk PAM On-Premises\nStrong proficiency in Microsoft Active Directory administration (forests, GPOs, trusts, replication)\nExperience administering Microsoft Exchange On-Premises (2016/2019)\nWorking knowledge of Mimecast administration and policy configuration\nExperience managing Microsoft 365 tenant administration and security features\nSolid understanding of IAM protocols and standards: SAML, OAuth 2.0, OIDC, SCIM, LDAP\nProficiency in PowerShell scripting for automation and administration\nFamiliarity with identity governance concepts: RBAC, SoD, least privilege, access certifications\nPreferred Qualifications\nRelevant certifications such as:\nPing Identity Certified Professional\nSailPoint Certified Identity Cloud\nCyberArk\nMicrosoft Certified: Identity and Access Administrator Associate (SC-300)\nCISSP, CISM, or CompTIA Security+\nExperience with Azure AD / Microsoft Entra ID in hybrid identity environments\nExposure to Privileged Identity Management (PIM) and Just-in-Time (JIT) access models\nFamiliarity with Zero Trust architecture principles\nExperience with ITSM platforms (ServiceNow, Jira) for access request workflows\nKnowledge of Python or another scripting language for IAM automation\nPrior experience with identity audit support and SOX / PCI / HIPAA compliance\nPay\nThis is a salaried position starting at $118,000.00(or applicable minimum salary, if higher) and pays up to $163,000.00, based on experience and qualifications.Benefits\nAll team members receive the following benefits while working for Life Time:\nA fully subsidized membership\n\nDiscounts on Life Time products and services\n\n401(k) retirement savings plan with company discretionary match (21 years of age and older)\n\nTraining and professional development\n\nPaid sick leave where required by law\n\nFull-time Team Members are eligible for additional benefits, including:\nMedical, dental, vision, and prescription drug coverage\n\nShort term and long term disability insurance\n\nLife insurance\n\nPre-tax flexible spending and dependent care plans\n\nParental leave and adoption assistance\n\nPaid time off, including 5 to 20 vacation days per calendar year (based on tenure) and paid sick leave\n\nDeferred compensation plan, if the team member meets the required income threshold\n\nLife Time is a place for everyone. As an organization, we are committed to an inclusive, diverse and equitable workplace that respects and celebrates the unique contributions of each individual while ensuring we remain an equal opportunity employer that recruits, hires, trains and promotes based on merit and qualifications.","description_format":"text","description_chars":8924,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Life insurance","Parental leave","Professional development","Retirement plans"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Fitness"],"lifecycle":[{"event":"open","at":"2026-11-13T21:49:39Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 6 · green card filings: 1","filings_12m":6,"filings_prev_12m":5,"green_card_filings_12m":1,"median_offered_wage_usd":137500,"route":null,"cap_exempt":false,"checked_at":"2026-11-12T07:36:15+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":1}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":34,"reasons":["conf:3","win:early","comp:brand"],"computed_at":"2026-11-14T01:12:48Z"},"pay":null,"html_url":"https://alion.io/job/life-time-senior-identity-access-management-engineer","json_url":"https://alion.io/job/life-time-senior-identity-access-management-engineer.json","meta":{"generated_at":"2026-11-14T01:12:48Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":697,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1811405},"rest":"https://alion.io/mcp/rest/get_company?id=1811405"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Flife-time-senior-identity-access-management-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Flife-time-senior-identity-access-management-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Flife-time-senior-identity-access-management-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/life-time-senior-identity-access-management-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Flife-time-senior-identity-access-management-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4285973}},{"tool":"search_jobs","arguments":{"company":"lifetime.life","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4285973},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}