IAM & AI Engineer (Identity and Access Management)

Sainsbury’s Group; City of Westminster; Hybrid; GBP 65,000 - 95,000; Full time

Benefits offered by this job

Colleague discount

Pensions scheme

Life cover

Performance bonus up to 10% of salary

Annual holiday allowance

Season ticket loans

Cycle to work scheme

Health cash plans

Pay advance

Employee assistance programme

Maternity/adoption leave up to 26 wks

Paternity leave up to 4 wks

Job summary

Sainsbury’s Group is seeking an experienced IAM specialist to strengthen identity governance and secure access across the organisation. You will work on Azure Entra ID (Azure AD) and related tooling, while leveraging AI/analytics to enhance identity security and lifecycle management.

You'll collaborate with Engineering, Product, Security Ops and partners to implement scalable IAM solutions, staying current on security best practices and emerging AI techniques to mitigate identity-based risks.

Qualifications

• Experience in IAM and security with strong technical foundations.
• Ability to leverage analytics for identity security and governance.
• Awareness of identity threat landscape and risk-based decisions.
• Ability to work with IT, product and security teams to deliver IAM roadmaps.
• Strong communication and delivery mindset, with focus on scalable IAM solutions.

Responsibilities

• Define AI or identity-analytics use cases (identity governance, lifecycle management, access risk).
• Analyze sign-in/log data to support investigations and identify trends.
• Deliver tasks aligned to IAM roadmaps with cross-functional teams.
• Collaborate with IT, product, security operations and partners to ensure secure IAM delivery.
• Convey findings clearly to stakeholders and maintain up-to-date knowledge of IAM/AI developments.
• Stay current with identity, security, and AI developments and apply new knowledge.

Skills

IAM fundamentals

AI-driven IAM initiatives

Identity telemetry analysis

Azure Entra ID / Azure AD expertise

Active Directory / AD concepts

Identity governance tooling

Collaborating with Eng/PM/Stakeholders

Communication & presentation

Secure IAM design & delivery

Continuous learning: identity/security

Tools

Saviynt

SailPoint

Microsoft Entra ID / Azure AD

Azure AD Connect

Conditional Access & MFA

Job description

• Practical experience in Identity & Access Management (IAM) principles including authentication, authorisation, Access control models (RBAC / ABAC / PBAC), identity lifecycle management (Joiners / Movers / Leavers) and an awareness of Zero Trust.
• Working knowledge of AI-driven or data-led initiatives within IAM or cybersecurity, with an understanding of how analytics can support identity security and governance.
• Ability to analyse identity telemetry (audit logs, sign-in logs, access data) to support investigations, identify trends, and contribute to operational and security improvements.
• Hands-on experience with Microsoft Entra ID (Azure AD), including:
  • User and group management (static and dynamic groups)
  • Role assignments, service principals, and application registrations
  • Familiarity with tenants, directories, objects, and attribute structures
  • Supporting Conditional Access, SSPR, MFA, and passwordless authentication (e.g. Windows Hello for Business, FIDO2)
  • Identity governance activities including Access reviews, Entitlement Management and access control models.
  • MS and 3rd party Agentic AI agents governance and lifecycle management.
• Engineering experience in Active Directory:
  • User and group management, OU structures, Group Policy Objects (GPOs)
  • Basic LDAP knowledge
  • Understanding of Hybrid identity integration (Azure AD Connect / Cloud Sync)
  • Awareness of AD tiering concepts and disaster recovery principles
• Experience working with Identity Governance tooling such as Saviynt / SailPoint or any other similar product.
• Ability to define AI or identity-analytics use cases, particularly in areas such as identity governance, lifecycle management, and access risk reduction.
• Awareness of the identity threat landscape and an understanding of how analytics or AI techniques can help detect and reduce identity-based risks.
• Ability to work with the Engineering Manager, Product Manager, Stakeholders and senior engineers to deliver technical tasks and milestones aligned to agreed IAM roadmaps.
• Proven ability to work collaboratively with IT teams, product teams, security operations, and service partners to support secure IAM delivery and protect colleague and customer data.
• Exhibit excellent communication and presentation skills, able to convey complex issues and findings clearly and effectively.
• Demonstrates a strong technical and delivery focussed mindset, able to follow designs, apply sound engineering practices, and contribute to secure, scalable IAM solutions.
• Shows a commitment to continuous learning, staying current with identity, security, and AI developments, and applying new knowledge to improve IAM services.

Additional Criteria

• Understanding of AI and machine learning concepts to analyse identity-related data (e.g. sign-in logs, access patterns, usage trends)
• Awareness of AI-assisted automation use cases within IAM:
  • Access or sign-in anomaly detection
  • Risk-based access decisions
  • Intelligent access reviews or entitlement recommendations
• Experience or familiarity with Microsoft security and analytics tools (e.g. Entra ID logs, Azure Monitor, Log Analytics, Sentinel).
• Awareness of ethical AI and responsible use of AI, especially in security-sensitive and personal-data contexts.
• Exposure to Privileged Access Management (PAM) solutions and role-based privileged access (hands-on experience beneficial but not essential)
• Understanding data governance, data quality, and information security principles, particularly where AI models consume identity data.
• Relevant professional certifications (or actively working towards), such as:
  • Microsoft Identity or Security certifications
  • AI / data analytics certifications
  • CISSP, CISM, or equivalent (desirable)

We'd all like amazing work to do, and real work-life balance. That's waiting for you at Sainsbury's. Think about the scale it takes for us to feed the nation. The level of data, transactions and variety it involves. Then you'll realise that ours is a modern software engineering environment because it has to be. We've made serious investment into a Tech Academy and into setting standards and principles. We iterate, learn, experiment and push ways of working such as Agile, Scrum and XP. So you can look forward to awesome opportunities in everything from AI to reusable tech., We are committed to being a truly inclusive retailer, so you'll be welcomed whoever you are and wherever you work. Around here, there's always the chance to try something new - whether that's as part of an evolving team or somewhere else across the business - and we take development seriously and promise to support you. We also recognise and celebrate colleagues when they go the extra mile and, where possible, offer flexible working.

When you join our team, we'll also offer you an amazing range of benefits. Here are some of them:

Starting off with colleague discount, you'll be able to get 10% off at Sainsbury's, Argos, TU and Habitat after 4 weeks. This increases to 15% off at Sainsbury's every Friday and Saturday and 15% off at Argos every pay day. We've also got you covered for your future with our pensions scheme and life cover. You'll also be able to share in our success as you may be eligible for a performance-related bonus of up to 10% of salary, depending on how we perform.

Your wellbeing is important to us too. You'll receive an annual holiday allowance, and you can buy additional holiday. We also offer other benefits that will help your money go further such as season ticket loans, cycle to work scheme, health cash plans, pay advance (where you can access some of your pay before pay day) as well access to a great range of discounts from hundreds of other retailers. And if you ever need it there is also an employee assistance programme.

Moments that matter are as important to us as they are to you which is why we give up to 26 weeks' pay for maternity or adoption leave and up to 4 weeks' pay for paternity leave.