Principal Identity & Access Management (IAM) Engineer

Aviso Wealth; Toronto; On-site; CAD 130,000 - 140,000; Full time

Benefits offered by this job

Competitive compensation

Health benefits

Generous vacation

Parental leave top‑up

Retirement matching

Education assistance

Social events

Job summary

Aviso Wealth is seeking an experienced Principal IAM Engineer to own end-to-end IAM strategy, architecture, and governance across internal and external identities. You will implement the model, configure tooling, and automate workflows for auditable access controls.

Ideal candidates bring 8+ years in IAM with RBAC/ABAC design, federation, and compliance in a regulated environment. Fluent English is required, French is a plus. Toronto-based with strong collaboration across teams.

Qualifications

• 8+ years IAM experience with authentication, authorization, federation, and governance.
• Hands-on with IGA platforms and PAM solutions.
• Proven RBAC/ABAC models and access certification programs.
• Strong federation and provisioning protocols: SAML, OIDC, OAuth 2.0, SCIM.
• Scripting/automation ability with PowerShell, Graph API, Python; IaC a plus.
• Experience governing external/B2B partner identities and lifecycle reviews.
• Regulated environment with audit/compliance fluency.
• Fluent English; French is a plus.

Responsibilities

• Own and evolve IAM strategy, policies, and standards across auth, authorization, lifecycle, and access governance.
• Oversee end-to-end identity architecture: workforce SSO/MFA, IGA, PAM, directory/federation, B2B identities.
• Drive joiner/mover/leaver lifecycle and delegated administration with auditable workflows.
• Grow access review, entitlement catalog, and SoD controls with audit-ready reporting.
• Implement design: configure platforms, build connectors, automate with PowerShell, Python, Terraform/Bicep.

Skills

IAM expertise

RBAC/ABAC design

SAML/OIDC/OAuth 2.0

SailPoint Saviynt Entra ID Governance

Okta CyberArk Entra ID

PowerShell Python

Terraform/Bicep

Federation & provisioning

Audit & compliance

English communication

Tools

SailPoint

Saviynt

Entra ID Governance

Okta

CyberArk

PowerShell

Graph API

Python

Terraform

Bicep

Job description

At Aviso, we are dedicated to improving the financial well-being of Canadians. As a leading wealth management organization, we are committed to leadership, innovation, partnership, responsibility, and community. Working with talented and energetic professionals who exemplify our values every day, you will quickly notice that our people and dynamic ‘oneaviso’ culture sets us apart. If you are looking for interesting and challenging work, at a company committed to its people, find out more about what Aviso has to offer at www.aviso.ca.

The Opportunity:

We’re looking to fill an opening for a Principal Identity & Access Management (IAM) Engineer to join our Technology Ops & Support Partners team.

Reporting to the Director, Technology Support Services, the Principal IAM Engineer is responsible for IAM end-to-end: defining the policies, standards, target-state architecture and building.

This is not a slideware role. You’ll design the model and then implement it — configuring tooling, writing automation, integrating applications, and standing up the governance that lets us prove who has access to what, for both internal users and external partners.

The Principal IAM Engineer will also monitor adherence to change governance requirements, support the end-to-end lifecycle of standard, normal, and emergency changes, and elevate exceptions, risks, and control gaps as required.

As one aviso:

• We Care– Youdo the right thing forclients,partnersand colleagues. Youbuild trusted relationships,championservice excellence, andcontribute to a culture where people feel valued and supported

• We Dare–You challenge the status quo with bold ideasand fresh perspectives. Youembrace change, seek opportunities toinnovateand are comfortable exploring new ways of working

• We Share– Youcollaborate openlyand build meaningful relationships. Youseek outdiverse perspectives, share yourknowledgeand work together to helpcolleagues,clientsand partners succeed

• We Deliver– Youtake ownership of your work,honouryourcommitmentsand focus on delivering meaningful results.You hold yourself accountable and continuously look for ways to improve

What your day looks like:

• Own and continuously evolve the enterprise Identity & Access Management (IAM) strategy, policies, and standards across authentication, authorization, lifecycle, and access governance, mapped to NIST CSF 2.0, CIRO, PIPEDA, and SOC/ITGC obligations, and translated into business-level risk for leadership
• Oversee the end-to-end identity architecture across workforce SSO/MFA, IGA, PAM, directory/federation, and B2B partner identity; guide the ongoing optimization of the toolset (e.g., Entra ID, Okta/Ping, SailPoint/Saviynt, CyberArk) and advance federation and provisioning patterns (SAML, OIDC, OAuth 2.0, SCIM, FIDO2) within a Zero Trust model
• Drive continuous improvement of the joiner-mover-leaver lifecycle for internal users and the onboarding/offboarding experience for external partner firms and advisors, expanding delegated administration, B2B federation, and least-privilege scoping through automated, auditable workflows
• Grow and improve the access review and recertification program across internal and external populations, refine the entitlement catalogue and SoD controls, and strengthen reporting so we can consistently demonstrate who has access to what, why, and when it was last reviewed with audit-ready evidence
• Implement what you design: configure platforms, build connectors and app onboarding, and automate with PowerShell/Microsoft Graph, Python, and Terraform/Bicep; partner with Security/CISO, Technology Ops, application owners, and external partner firms to support audits and regulatory reviews

Your experience and skills:

• 8+ years of experience in IAM, with deep, demonstrated coverage of authentication, authorization, federation, identity governance, and directory services
• Hands-on experience across the stack: at least one IGA platform (e.g., SailPoint, Saviynt, or Entra ID Governance), a workforce identity platform (Entra ID and/or Okta), and a PAM solution
• Proven design of RBAC/ABAC models, entitlement catalogues, SoD controls, and access certification / recertification programs
• Strong capability with federation and provisioning protocols: SAML, OIDC, OAuth 2.0, SCIM
• Proven scripting/automation ability — you can build, not just specify (PowerShell + Graph API, Python; IaC a plus)
• Experience with governing external / B2B partner identity — federation with partner IdPs, delegated administration, and lifecycle/reviews for external users
• Track record in a regulated environment (financial services strongly preferred) with audit and compliance fluency
• Able to translate technical access risk into clear business and executive-level risk language
• Fluent communication skills in English are required and bilingual skills in French are an asset

Why Aviso?

At Aviso, you will find a dynamic and inclusive culture that rewards innovation and celebrates success.

Here are a few things that set us apart:

• Competitive compensation package that rewards and recognizes individual contributions
• Excellent health, dental and insurance benefits to meet the diverse needs of our employees
• Generous vacation time, fitness benefit, parental leave top‑up options
• Matching contributions to our retirement program
• Commitment to the continuous improvement of our staff through learning & development and an education assistance program
• Regular social events to foster teamwork

Your Information

By submitting your application, you consent to the collection, use, and disclosure of your provided personal information for the purposes of assessing your qualifications and suitability for employment with Aviso. Your information will be handled in accordance with applicable Canadian privacy laws, including thePersonal Information Protection and Electronic Documents Act (PIPEDA)and relevant provincial legislation. Your data may be shared with authorized personnel involved in the recruitment process and retained only as long as necessary to fulfill these purposes or as required by law.

Further information is available on the Privacy link on our Career Page – Privacy Policies

Equal Employment Opportunity

Aviso welcomes and encourages applications from all qualified individuals including persons with disabilities. If you require an accommodation, we will work with you to meet your needs in all stages of the hiring process.

Company Overview:

Aviso is a leading wealth management and investment services provider for the Canadian financial industry, with approximately $145 billion in total assets under administration and management, and over 1,000 employees. We’re building a comprehensive, technology-enabled, client‑centric wealth services ecosystem. Our clients include our partners, advisors, and investors. We’re a trusted partner for nearly all credit unions across Canada, in addition to a wide range of portfolio managers, investment dealers, insurance and trust companies, and introducing brokers. Our partners depend on Aviso for specific solutions that give them a competitive edge in a rapidly evolving, highly competitive industry. Our investment dealer and mutual fund dealer and our insurance services support thousands of investment advisors. Our asset manager, NEI Investments, specializes in investing responsibly. Our online brokerage, Qtrade Direct Investing®, empowers self‑directed investors, and our fully automated investing service, Qtrade Guided Portfolios®, serves investors who prefer a hands‑off approach. Aviso Correspondent Partners provides custodial and carrying broker services to a wide range of firms. We have offices in Toronto, Vancouver, and Montreal. Aviso is backed by the collective strength of our owners: the credit union Centrals, Co‑operators/CUMIS, and Desjardins. We’re proud to power businesses that empower investors.

Salary

This position is posted with an expected salary range of $130,000 - $140,000 CAD annually. Individual compensation packages are based on various factors unique to each candidate and the requirements of the position.