security engineer in identity and access management

Enfint; Deutschland; Hybrid; EUR 90,000 - 140,000; Full time

Benefits offered by this job

Здоровье, стоматология и зрение

Гибкий график

Двухнедельные паузы ч/г

Долгосрочная программа поощрения

Обучение и развитие

Job summary

Relativity ищет опытного инженера по идентификации и безопасности для разработки и поддержки корпоративной IAM‑платформы. Ваша работа охватит архитектуру идентификации, внедрение Zero Trust, MFA, SSO и управление доступом в гибридной multi‑cloud среде.

Требуется 8+ лет опыта в IAM, знание Okta, Entra ID/AzureAD, Ping, SailPoint, CyberArk и BeyondTrust, владение SAML/OIDC/OAuth2.0, навыки Python/PowerShell и наставничество коллег.

Qualifications

• Бакалавр в области CS, информации или эквивалентный опыт.
• 8+ лет hands-on опыта в enterprise IAM или security engineering с фокусом на идентичность
• Опыт архитектуры идентификационных платформ: Okta, Entra ID/AzureAD, Ping, SailPoint, Saviynt, CyberArk, BeyondTrust
• Продвинутые знания SAML, OIDC, OAuth2.0, SCIM, LDAP, Kerberos
• Опыт лидерства в обнаружении угроз идентификации и расследования доступа
• Умение автоматизировать правила доступа и обеспечивать наблюдаемость
• Знание MITRE, NIST800-63, Zero Trust framework"],
• job_responsibilities_description

Responsibilities

• Разработка архитектуры идентификации для рабочих нагрузок и сотрудников.
• Развитие возможностей адаптивного доверия в рамках Zero Trust.
• Проектирование и оптимизация ZTNA, MFA/FIDO2, JIT доступ.
• Проектирование и стандарты SSO и федерации для SaaS и облака.
• Определение и настройка процессов соответствия и управления доступом.
• Автоматизация жизненного цикла идентификации через HR-системы и директории.
• Руководство внедрением IGA: обзоры доступа, сертификационные кампании.
• Внедрение PAM: хранение учетных данных, JIT повышение, мониторинг сессий.
• Участие в интеграции идентичности с SIEM/SOAR и UEBA.
• Разработка инцидент-ответов с учётом идентичности.

Skills

Identity engineering

SAML / OIDC

OAuth2.0

Python

PowerShell

Zero Trust

Mentoring

Коммуникация

Education

Бакалавр в CS или информационной безопасности

Магистр в кибербезопасности

Tools

Okta

Entra ID/AzureAD

Ping

SailPoint

Saviynt

CyberArk

BeyondTrust

Job description

Описание:

Relativity develops software products and services for legal technology, e-discovery, litigation holds, and digital forensics.

Задачи:

• Design identity architecture across workforce, machine, and workload identity domains;
• Advance continuous adaptive trust capabilities within the enterprise Zero Trust architecture;
• Engineer and optimize ZTNA, least-privilege micro-segmentation, MFA/FIDO2, and JIT access;
• Design and optimize SSO, federation, and authentication standards across SaaS and multi-cloud environments;
• Define and tune hardening standards with automated compliance validation;
• Design and optimize identity lifecycle automation integrating HR systems, directories, and downstream applications;
• Engineer IGA capabilities, including access reviews, certification campaigns, and segregation-of-duties enforcement;
• Lead implementation and optimization of PAM, including credential vaulting, JIT elevation, and session monitoring;
• Design governance for non-human identities with automated drift detection and policy-as-code enforcement;
• Lead integration of identity telemetry into SIEM/SOAR and UEBA detection stacks;
• Develop identity-focused incident response playbooks;
• Apply threat intelligence context to prioritize identity exposure remediation;
• Lead identity-focused purple team engagements;
• Design identity controls embedded in AI-augmented CI/CD pipelines;
• Define and track identity KPIs;
• Partner with GRC on identity controls aligned to SOX, SOC 2, ISO 27001, HIPAA, GDPR, and CCPA;
• Support audits, certifications, e-discovery, and forensic integrity requirements;
• Provide technical guidance and mentorship to Advanced and Engineer-level identity engineers.

Требования:

• Bachelor's degree in Computer Science, Information Security, or equivalent experience;
• 8+ Years of hands‑on experience in enterprise IAM or security engineering with deep specialization in identity, authentication, and access domains;
• alternatively, a Master's degree in Cybersecurity or a relevant field with 6+ years of experience;
• Expert hands‑on experience architecting and operating identity platforms across Okta, Entra ID/AzureAD, Ping, SailPoint, Saviynt, CyberArk, and BeyondTrust;
• Advanced knowledge of SAML, OIDC, OAuth2.0, SCIM, LDAP, and Kerberos;
• Experience leading identity threat detection, complex access investigations, and detection-engineering efforts;
• Ability to design automation for access enforcement and observability;
• Working command of MITRE, NIST800‑63, and Zero Trust frameworks;
• Proficiency in Python, Bash, or PowerShell applied to containerized services, CLI‑based commands, and identity‑specific use cases;
• Ability to mentor engineers and communicate technical strategy and findings clearly to engineering peers, leadership, and non‑technical stakeholders;
• Nice to have: Experience securing SaaS, cloud‑native, or globally distributed regulated environments, cloud IAM across AWS, Azure, or GCP, securing non‑human/workload identities at scale, AI‑augmented security and governance, identity controls in CI/CD and infrastructure‑as‑code environments, legal technology and e‑discovery, digital forensics chain‑of‑custody requirements, compliance and audit engagements, CISSP, CISM, GCIH, GCFA, CCSP, AWS Security Specialty, SC‑300, or AZ‑500.

Условия:

• Comprehensive health, dental, and vision plans;
• Parental leave for primary and secondary caregivers;
• Flexible work arrangements;
• Two, week-long company breaks per year;
• Additional time off;
• Long‑term incentive program;
• Training investment program;
• Competitive base salary, annual performance bonus, and long‑term incentives;
• The final offered salary will depend on experience, skills, qualifications, and internal pay equity.