Senior IAM / PAM Engineer

The Senior IAM/PAM Engineer serves as the technical lead and subject matter expert for both Privileged Access Management (PAM) and Identity Governance & Administration (IGA). This role provides technical leadership, drives architecture decisions, and leads hands-on implementation, configuration, and automation for the Delinea PAM suite and SailPoint ISC. The engineer will bridge the gap between privileged access and identity governance, ensuring a unified, automated, and secure environment. This role is critical to program success, requiring the ability to mentor junior engineers, lead technical workstreams, and translate business requirements into scalable solutions across both platforms.

The core responsibilities for the job include the following:

Leadership and Strategy:

• Provide technical leadership and mentorship to engineering teams on PAM and IGA best practices.
• Lead the design and integration strategy between Delinea and SailPoint ISC.
• Drive continuous improvement initiatives, including lifecycle management, role mining, and access governance.
• Act as the escalation point (Tier 3/4) for complex, cross-platform IAM/PAM issues.

Platform Management (Delinea):

• Lead the installation, configuration, and maintenance of the full Delinea platform (Secret Server, Privilege Manager, Session Manager, and Secure Remote Access).
• Drive the onboarding of privileged accounts, service accounts, and API keys with automated password rotation.
• Architect and manage access controls, folders, secret templates, and session monitoring (RDP, SSH, web).

Identity Governance (SailPoint ISC):

• Lead the configuration and management of SailPoint ISC, including identity lifecycle, access requests, certifications, and role management.
• Design and implement complex SailPoint workflows, rules, and transforms.
• Manage source integrations (Active Directory, HR systems, cloud apps) and ensure authoritative source alignment.

Integration and Automation:

• Architect and maintain bi-directional integrations between Delinea and SailPoint ISC (e. g., automated access granting/revoking, privileged account governance, and emergency access workflows).
• Develop advanced automation scripts (PowerShell, Python, SailPoint APIs, Delinea SDK) to orchestrate IAM/PAM processes.
• Integrate both platforms with enterprise systems (ServiceNow, Splunk, SIEM, SOAR).

Requirements:

• Leadership: 5+ years of combined IAM/PAM experience, including leading technical workstreams, mentoring peers, and driving architectural decisions.
• Delinea Expertise (3+ years hands-on): Deep knowledge of Secret Server architecture, Distributed Engine, secret templates, access policies, session management, and API integrations.
• SailPoint ISC Expertise (2+ years hands-on): Deep knowledge of identity lifecycle, provisioning, role-based access control (RBAC), access certifications, and native SailPoint ISC workflows.
• Integration Mastery: Proven experience integrating Delinea with SailPoint ISC (using REST APIs, OAuth clients, or custom connectors).
• Scripting and Automation: Advanced PowerShell and Python skills for automation, including using the PowerShell SDK from both vendors.
• Core IAM/PAM Concepts: Privileged vaulting, session management, least privilege, SSO, provisioning, governance, RBAC, SOD (segregation of duties), and certification processes.
• Infrastructure and Security: Strong Windows/Linux security, AD/LDAP, DNS, firewalls, OAuth 2.0/OIDC, and token management.

Desirable Skills (Strongly Preferred):

• Experience with Delinea AI/PAM-I (risk scores, anomaly detection).
• Knowledge of low-code integration brokers (Azure Logic Apps, Power Automate, AWS Step Functions).
• Familiarity with SCIM, Graph API, or Event Hub integrations.
• IAM certifications (e. g., CIAM, CISSP) or vendor-specific ones (Delinea Certified Engineer, SailPoint Certified Engineer/Architect).

Skills

Delinea, IAM, IGA, ISC, PAM, SailPoint