Identity & Access Engineer Senior

Job Title: Identity and Access Management (IAM) Senior Engineer

Role/Job Summary:

We are looking for an Identity and Access Management (IAM) Senior Engineer to act as the senior technical owner of enterprise identity platforms. The role requires deep hands-on expertise in SailPoint Identity Governance and Administration (IGA) and Microsoft Entra ID, and the ability to design and lead secure, scalable identity solutions across workforce, customer and cloud environments that meet business, security and compliance requirements.

Key Responsibilities:

• Advanced IAM engineering: Design and implement advanced IAM solutions across workforce and customer identity platforms, optimize identity lifecycle workflows, and enforce least-privilege, policy-driven access models.
• Microsoft Entra ID operations: Administer and engineer Entra ID across multiple geographies, covering users, groups, applications, service principals, Conditional Access, Multi-Factor Authentication (MFA), identity protection, session controls, enterprise applications and consent governance.
• Cloud tenant setup: Stand up, configure and document cloud tenants for multi-regional business areas and regional compliance needs, including network connectivity, authentication, authorization and SailPoint integration.
• Hybrid identity and governance: Partner with security, infrastructure and application teams on hybrid identity, directory synchronization, privileged access, access reviews and audit-ready entitlement governance, and monitor sign-in activity, risky access patterns and identity health.
• SailPoint IGA leadership: Lead SailPoint implementations and enhancements, including complex provisioning logic, role engineering, access models, certification campaign design, and troubleshooting of complex SailPoint and connector issues.
• Customer Identity and Access Management (CIAM) and federation: Design and support CIAM architectures, including external identity federation with Entra ID or Okta and secure customer authentication and authorization flows, keeping controls consistent with workforce IAM.
• Non-human and AI identity: Design and secure frameworks for service principals, workloads, automation and AI-driven identities, with appropriate controls and governance over machine and AI access.
• Architecture and design ownership: Create and maintain reference architectures, technical design documents, integration standards and reusable engineering standards for SailPoint, Entra ID, CIAM, cloud tenants, federation and identity automation, documenting decisions, risks, assumptions and dependencies.
• Technical decision-making: Recommend platform direction and control patterns, evaluate technical risks and tradeoffs, and influence engineering teams, application owners, security stakeholders and audit partners with clear, defensible guidance.
• Audit, compliance and risk: Own the IAM audit evidence strategy (traceable access decisions and repeatable evidence collection) and map IAM controls to SOC 2 (System and Organization Controls 2), ISO/IEC 27001, CMMC (Cybersecurity Maturity Model Certification) and internal policy requirements.
• CI/CD (Continuous Integration / Continuous Delivery) and Infrastructure as Code (IaC): Deliver IAM controls, SailPoint configurations and cloud tenant changes through source-controlled DevOps pipelines and IaC for consistent, repeatable and secure delivery.
• Incident escalation: Lead diagnosis and resolution of complex IAM outages, incidents and escalated support cases, with clear communication and coordination across Level 3 (L3) and senior technical teams.
• Project delivery: Act as technical lead and accountable engineering owner for complex IAM projects, defining deliverables, timelines and success criteria and delivering securely and on schedule.
• Research and innovation: Evaluate emerging identity technologies, drive improvement initiatives and technical experimentation, and turn outcomes into reusable IAM patterns aligned with security architecture and policy standards.
• Mentorship: Mentor IAM engineers, review technical designs, and raise IAM delivery maturity through documentation, coaching and design reviews.

Must-Have Skills:

• Strong hands-on experience with SailPoint IGA (provisioning, role engineering, access certifications, connectors)
• Hands-on Microsoft Entra ID experience in large enterprises: Conditional Access, MFA, enterprise applications, hybrid identity, privileged access, access reviews and identity lifecycle
• Deep knowledge of IAM protocols, federation and identity lifecycle design
• Experience standing up and documenting multi-regional cloud tenants, including complex network connectivity, authentication, authorization and SailPoint integration
• Proven experience supporting compliance audits
• CI/CD, DevOps-based delivery and Infrastructure as Code practices for cloud, IAM and SailPoint implementations
• Strong troubleshooting and architecture skills, including ownership of escalated IAM incidents
• Ability to mentor engineers and influence technical and business stakeholders

Good-to-Have Skills:

• Leading large-scale SailPoint implementations, upgrades, connector integrations, role engineering or access certification modernization
• Engineering Microsoft Entra ID in complex enterprise environments, including workload identities
• Azure DevOps, Git-based development, CI/CD pipelines, Terraform or similar Infrastructure as Code tooling
• Experience in SOC 2, ISO/IEC 27001, CMMC or other regulated control environments
• Designing controls for service accounts, service principals, automation, workload and AI-enabled non-human identities
• CIAM federation experience with Okta

Experience Required:

7+ Years

• 7+ years in IAM, identity security, infrastructure, cloud security or related enterprise security engineering roles
• 5+ years of hands-on experience with enterprise IAM platforms
• 3+ years designing or leading SailPoint, Microsoft Entra ID, federation or cloud identity implementations