Lead IAM Engineer

EPAM Systems; Colombia; On-site; COP 223,864,000 - 351,786,000; Full time

Benefits offered by this job

Healthcare benefits

Global career opportunities

Paid time off and sick leave

Upskilling and certification courses

LinkedIn Learning access

Job summary

EPAM Systems is seeking a hands-on Lead IAM Engineer to develop and drive a large-scale migration from Okta Workforce Identity to Microsoft Entra ID across a complex enterprise architecture. You will set migration standards, solve the hardest integration challenges, and partner with stakeholders to deliver a secure, reliable transition.

You will own the target architecture, define migration sequencing, and lead re-platforming of SAML and OpenID Connect integrations while retiring legacy

Qualifications

• 5+ years of identity engineering experience.
• Experience moving from Okta to Entra ID across many apps.
• Proven technical leadership in large migrations.
• Strong collaboration with stakeholders and compliance teams.
• Proficient in OAuth2, SAML, OIDC, and federation patterns.
• Fluent English (B2) communication.

Responsibilities

• Own target architecture and migration strategy from Okta to Entra ID.
• Define migration patterns, sequencing, and standards for re-platforming SAML and OIDC.
• Design federation configurations, claims mapping, and policy parity.
• Lead migration for retiring legacy SMS auth and interim MFA.
• Troubleshoot authentication issues during migration waves.
• Coordinate with project manager on scoping and risk inputs.
• Document decisions in Confluence and track work in Jira.
• Partner with compliance when migration timing affects audits.

Skills

Identity engineering

Technical leadership

Clear communication

English B2+

Tools

Okta Workforce Identity

Microsoft Entra ID

SAML

OpenID Connect

OAuth2

Confluence

Jira

Job description

EPAM is a leading global provider of digital platform engineering and development services. We are committed to having a positive impact on our customers, our employees, and our communities. We embrace a dynamic and inclusive culture. Here you will collaborate with multi-national teams, contribute to a myriad of innovative projects that deliver the most creative and cutting-edge solutions, and have an opportunity to continuously learn and grow. No matter where you are located, you will join a dedicated, creative, and diverse community that will help you discover your fullest potential.

We are seeking a hands-on Lead IAM Engineer to develop and drive a large-scale migration from Okta Workforce Identity to Microsoft Entra ID across a complex enterprise application landscape. You will set migration standards, solve the hardest integration challenges, and partner with stakeholders to deliver a secure, reliable transition.

Responsibilities

• Own the target architecture and migration strategy to move workforce identity capabilities from Okta to Microsoft Entra ID
• Define migration patterns, sequencing, and technical standards for re-platforming SAML and OpenID Connect integrations
• Design and validate federation configurations, claims mapping, and policy parity across identity providers
• Lead technical approach for retiring legacy SMS authentication and transitioning users to an interim MFA solution
• Serve as escalation point for complex application onboarding and migration defects
• Execute or review high-risk migrations, including non-standard federation and service-to-service flows
• Build runbooks, reference architectures, and reusable configuration templates to accelerate delivery
• Validate identity lifecycle, provisioning, and conditional access behavior before and after cutovers
• Troubleshoot authentication failures across federation, tokens, and attribute mappings during migration waves
• Partner with a technical project manager on scoping, sequencing, and risk inputs without owning program deliverables
• Document technical decisions and configurations in Confluence and track work in Jira
• Coordinate with compliance stakeholders when migration timing affects audit and control testing windows

Requirements

• 5+ years of identity engineering experience with production design and troubleshooting
• Okta Workforce Identity experience supporting workforce IdP use cases
• Microsoft Entra ID experience across authentication and policy design
• SAML and OpenID Connect experience for application federation
• Technical leadership experience setting standards and reviewing designs
• Large-scale migration experience leading IdP re-platforming across many applications
• Strong OAuth2 client-credentials knowledge for service-to-service authentication
• Solid troubleshooting skills for claims mapping, token issuance, and auth failures
• Clear communication skills to explain trade-offs to technical and non-technical partners
• Upper-Intermediate English proficiency (B2)
• Atlassian Jira proficiency for tracking engineering work
• Atlassian Confluence proficiency for documenting decisions and runbooks

Nice to have

• Agile delivery experience in cross-functional engineering teams
• Scaled Agile Framework (SAFe) experience
• Privileged Access Management (PAM) experience in enterprise environments

We offer

• International projects with top brands
• Work with global teams of highly skilled, diverse peers
• Healthcare benefits
• Employee financial programs
• Paid time off and sick leave
• Upskilling, reskilling and certification courses
• Unlimited access to the LinkedIn Learning library and 22,000+ courses
• Global career opportunities
• Volunteer and community involvement opportunities
• EPAM Employee Groups
• Award-winning culture recognized by Glassdoor, Newsweek and LinkedIn

EPAM is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, sexual orientation, gender identity or expression, disability, protected veteran status, or any other characteristic protected by applicable law.