Chief IAM Engineer

EPAM Systems; Colombia; On-site; COP 180,000,000 - 300,000,000; Full time

Benefits offered by this job

Unlimited learning platforms

Comprehensive health plan for you and

Vision health stipend up to COP 200,00

Life insurance with MetLife

Medical leave coverage 90 days

Career growth opportunities

Stock purchase plan

Referral/Interview opportunities

Global EPAM community

Job summary

EPAM Systems is seeking a Chief IAM Engineer in Colombia to lead the migration of workforce identity from Okta to Microsoft Entra ID. You will set standards, guide architecture decisions, and partner with delivery and governance teams to ensure secure outcomes.

You will own the technical design for federation, token flows, and identity lifecycle validation, while mentoring teams and documenting configurations for scalable operations.

Qualifications

• 7+ years hands-on identity engineering with Okta Workforce Identity and Microsoft Entra ID.
• Proven leadership owning architecture decisions and engineering standards.
• Large-scale IdP migration experience across many applications.
• Advanced SAML expertise including federation setup and mapping.
• Advanced OpenID Connect expertise including token design and troubleshooting.
• Strong documentation skills using Confluence and Jira.
• English proficiency Upper-Intermediate (B2).

Responsibilities

• Own the technical architecture and migration strategy for Okta to Entra ID.
• Define migration patterns, sequencing, and standards for transitioning apps.
• Design and validate federation configurations, claims mapping, and access parity.
• Lead design for retirement of Okta SMS and transition to Okta Verify.
• Serve as escalation point for complex onboarding and migration issues.
• Execute or review high-complexity migrations, including non-standard flows.
• Build migration runbooks, reference architectures, and templates.
• Validate identity lifecycle, provisioning, and conditional access post-cutover.
• Troubleshoot federation, token issuance, and authentication failures.
• Document decisions in Confluence; track work in Jira.

Skills

Identity engineering

Architecture leadership

Okta

Entra ID

SAML

OpenID Connect

Confluence

Jira

English B2

Communication

Tools

Confluence

Jira

Job description

We are seeking a Chief IAM Engineer to lead the technical architecture and hands‑on execution of a workforce identity platform migration from Okta Workforce Identity to Microsoft Entra ID. You will set standards, solve complex migration issues, and partner with delivery and governance stakeholders to drive secure outcomes.

Responsibilities

• Own the technical architecture and migration strategy for moving Okta Workforce Identity capabilities to Microsoft Entra ID
• Define migration patterns, sequencing, and technical standards for transitioning a large application portfolio from Okta to Entra ID
• Design and validate SAML and OpenID Connect federation configurations, claims mapping, and access policy equivalency
• Lead technical design for retiring the Okta SMS authentication factor and transitioning users to Okta Verify as an interim step
• Serve as the technical escalation point for complex application onboarding and migration issues
• Execute or technically review high‑complexity migrations, including non‑standard federation and service‑to‑service flows
• Build and maintain migration runbooks, reference architectures, and reusable configuration templates
• Validate identity lifecycle, provisioning, and conditional access parity before and after cutovers
• Troubleshoot and resolve defects related to federation, token issuance, claims mapping, and authentication failures
• Partner with the Technical Project Manager on technical scoping, sequencing, and risk input without owning program deliverables
• Document technical decisions and configurations in Confluence and track engineering work in Jira

Requirements

• 7+ years of hands‑on identity engineering experience with Okta Workforce Identity and Microsoft Entra ID in production
• Proven technical leadership experience owning architecture decisions and setting engineering standards for identity platforms
• Large‑scale IdP migration experience re‑platforming SAML and OpenID Connect integrations across many applications
• Advanced SAML expertise including federation setup, claims/attribute mapping, and troubleshooting
• Advanced OpenID Connect expertise including token and claims design and troubleshooting
• Strong documentation skills using Atlassian Confluence and work tracking in Atlassian Jira
• English proficiency Upper-Intermediate (B2)
• Strong communication skills explaining technical trade-offs and risks to engineering and non‑technical stakeholders

Nice to have

• Agile delivery experience supporting iterative planning and execution
• Privileged Access Management (PAM) experience understanding identity dependencies
• Scaled Agile Framework experience working within SAFe cadences

We offer

• Learning Culture - We want you to be the best version of yourself, that is why we offer unlimited access to learning platforms, a wide range of internal courses, and all the knowledge you need to grow professionally
• Health Coverage - Health and wellness are important, that is why we have you and up to four family members in a premiere health plan. We have a couple of options, so you can choose what is best for you and your family
• Visual Benefit - Seeing your work for us would be a sight for sore eyes. We want your vision to always be at 100% which is why we offer up to $200.000 COP for any visual health expenses
• Life Insurance Plan - We have partnered with MetLife to offer a full‑coverage Ife insurance plan. So, your family is covered, even if you are gone.
• Medical Leave Coverage - We are one of the few companies that cover 100% of your medical leave, for up to 90 days. Your health is the most important thing to us
• Professional Growth Opportunities - We have designed a highly competitive and complete development process, where you will have all the tools to get where you have always wanted to be, personally and professionally
• Stock Option Purchase Plan - As an EPAMer you can be more than just an employee, you will also have the opportunity to purchase stock at a reduced price and become a part owner of our organization
• Additional Income - Besides your regular salary, you will also have the chance to earn extra income by referring talent, being a technical interviewer, and many more ways
• Community Benefit - You will be part of a worldwide community of over 50,000 employees, where you can learn, challenge yourself, stand out, and share your knowledge and experience with multicultural teams!

EPAM is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, sexual orientation, gender identity or expression, disability, protected veteran status, or any other characteristic protected by applicable law.

We accept CVs in English only.

Please note that even though you are applying for this position, you may be offered other projects to join within EPAM.

EPAM is a leading global provider of digital platform engineering and development services. We are committed to having a positive impact on our customers, our employees, and our communities. We embrace a dynamic and inclusive culture. Here you will collaborate with multi‑national teams, contribute to a myriad of innovative projects that deliver the most creative and cutting‑edge solutions, and have an opportunity to continuously learn and grow. No matter where you are located, you will join a dedicated, creative, and diverse community that will help you discover your fullest potential.