Senior IAM Engineer

Kidde Global; São Paulo; Hybrid; BRL 270,000 - 330,000; Full time

Job summary

Kidde Global Solutions seeks a senior in-house IAM engineer based in Brazil to lead enterprise identity platforms including Saviynt IGA/PAM, SSO, and CIAM. You will own complex design, configuration, integration, automation, and escalation with L2–L4 responsibility while MSP handles L1 ops.

You will partner with global teams across IT, security, HR, and business units to strengthen identity governance, reduce risk, and improve automation and resilience.

Qualifications

• Bachelor’s degree or equivalent in a relevant field with 8+ years IAM experience.
• Hands-on engineering with Saviynt or comparable IGA/PAM platforms.
• Experience building connectors, workflows, and application onboarding for enterprise IAM.
• CIAM experience with Entra External ID, Azure AD B2C, Okta/Auth0, Ping, or similar.
• Fluency in English and Portuguese; willingness to participate in identity incident on-call.

Responsibilities

• Onboard applications into Saviynt; build connectors, forms, workflows, and onboarding rules.
• Design and run UAR and PAR campaigns with SOX- and critical-app coverage; provide audit-ready evidence.
• Administer privileged-access vault; manage service accounts, credential governance, and onboarding.
• Design and operate CIAM for customers and partners, including registration, authentication, and lifecycle governance.
• Support SSO governance; onboard apps using SAML/OIDC/OAuth and decommission legacy auth.
• Automate identity tasks and develop dashboards using PowerShell, Graph, and REST APIs.

Skills

Identity engineering

Technical problem solving

Automation and improvement

Risk and compliance

Operational ownership

Collaboration and communication

Education

Bachelor’s degree in Computer Science, Information Systems, or a related field

Tools

Saviynt IGA/PAM

Microsoft Entra ID

Azure AD B2C

Okta/Auth0

Ping

Microsoft Graph

PowerShell

REST APIs

Job description

Role Purpose

This role exists to serve as KGS’s senior in-house engineer for enterprise identity platforms, including Saviynt Identity Governance & Administration (IGA), Saviynt Privileged Access Management (PAM), single sign-on (SSO), and Customer Identity & Access Management (CIAM). The role owns Level 2 through Level 4 engineering work across design, configuration, integration, automation, and complex escalation, while the managed service provider continues to deliver Level 1 operations.

Based in Brazil, the role extends IAM coverage across the Americas and EMEA and provides trained backup for Active Directory, Microsoft Entra ID, and Microsoft 365 identity services. The role partners with the Senior Manager, Identity & Cloud Security, GRC, Infrastructure & Operations, HR, application owners, and service providers to strengthen identity governance, reduce operational risk, and improve automation and service resilience.

Role Accountabilities

This outlines the typical and expected accountabilities for this role:

• Identity Governance & Administration: Onboard applications into Saviynt; build and maintain connectors, forms, workflows, request catalogs, and joiner-mover-leaver rules; and resolve synchronization issues between Dayforce and downstream systems.
• Access Certifications: Design and run User Access Review (UAR) and Privileged Access Review (PAR) campaigns, including advanced configuration for SOX-scoped and critical applications, and produce audit-ready evidence.
• Privileged Access Management: Administer the privileged-access vault and own service-account discovery, server onboarding, credential governance, AWS and Azure landing-zone integration, onboarding automation, and orphaned-account remediation.
• Customer & External Identity: Design, build, and operate CIAM capabilities for customers, partners, and other external users, including registration, authentication, federation, consent, and lifecycle governance.
• SSO & Modern Authentication: Onboard applications using SAML, OIDC, OAuth, and related provisioning standards; support retirement of legacy authentication; and apply established SSO governance and reporting standards.
• Automation & Reporting: Automate identity lifecycle and operational tasks and develop dashboards and metrics using PowerShell, Microsoft Graph, REST APIs, and related tooling.
• Identity Platform Coverage: Serve as trained backup for Active Directory and Microsoft Entra ID capabilities, including Conditional Access, PIM, Group Policy, PKI, and Microsoft 365 identity controls.
• Incident Response & On-Call: Participate in the identity on-call rotation and lead triage, root-cause analysis, and remediation for complex identity incidents.
• Operations & Managed Services: Provide Level 2–Level 4 identity support, act as the escalation point for the managed service provider, review Level 1 service quality, and maintain runbooks and knowledge transfer to reduce key-person dependency.
• Risk, Audit & Continuous Improvement: Support SOX, ISO 27001, and NIST-aligned controls; remediate audit findings; maintain control evidence; and identify opportunities to improve reliability, security, self-service, and user experience.

Role Competencies

Core Competencies

These are critical and fundamental to perform the role:

• Identity engineering: Deep hands-on expertise in IGA, PAM, SSO, federation, authentication, and identity lifecycle management at enterprise scale.
• Technical problem solving: Diagnosing complex integrations, synchronization failures, access issues, and platform defects through structured analysis and root-cause remediation.
• Automation and improvement: Using scripting, APIs, reusable patterns, and self-service to reduce manual effort and improve control consistency.
• Risk and compliance: Translating SOX, ISO 27001, and NIST-aligned requirements into sustainable identity controls and audit-ready evidence.
• Operational ownership: Managing escalations, incidents, changes, documentation, and service-provider handoffs with urgency and accountability.
• Collaboration and communication: Working effectively with global technical teams, business stakeholders, auditors, and external partners in English and Portuguese.

Qualifications (Education, Experience, Technical Knowledge)

Key qualifications relevant to this role:

• Bachelor’s degree in Computer Science, Information Systems, or a related field, or equivalent experience.
• 8+ years of Identity & Access Management experience, including 3+ years of hands-on engineering experience with Saviynt or a comparable IGA/PAM platform.
• Demonstrable experience building connectors, workflows, request processes, and application onboarding in an enterprise IGA platform.
• Hands-on CIAM experience with Microsoft Entra External ID, Azure AD B2C, Okta/Auth0, Ping, or a comparable platform.
• Strong PAM knowledge, including vaulting, credential rotation, service-account governance, privileged onboarding, and session management.
• Working knowledge of Microsoft Entra ID, Active Directory, Conditional Access, PIM, Group Policy, PKI, and SAML/OIDC/OAuth protocols.
• Automation skills using PowerShell, REST APIs, Microsoft Graph, or comparable technologies.
• Experience supporting SOX and/or ISO 27001 audits and producing control evidence.
• Fluency in English and Portuguese and willingness to participate in identity incident on-call support.
• Saviynt IGA/PAM certification and Microsoft SC-300 are preferred; CISSP, CISM, or CIAM-related certifications are beneficial.
• Experience working with global teams, managed service providers, and distributed stakeholders is preferred.