IAM Engineer

TESTQ Technologies; Greater London; On-site; GBP 90,000 - 130,000; Full time

Job summary

TESTQ Technologies in Greater London is seeking a Senior IAM Engineer to drive IAM service transition, privileged access transformation and identity security improvements across Entra ID, Active Directory, CyberArk and ServiceNow. The role will lead operational handover, strengthen access controls and improve governance across human and non-human identities.

You will work independently to a high standard, perform hands-on engineering, define runbooks, and mentor teams while aligning with

Qualifications

• 6-10 years in IAM Cyber Security.
• Experience with PAM tools like CyberArk.
• Experience with SSO, MFA and identity governance.
• Proficient in scripting for operational tasks (PowerShell).

Responsibilities

• IAM Service Transition Operations.
• Define IAM service scope operating model and RACI across support teams.
• Configure and optimize ServiceNow groups, workflows and ticket routing.
• Define and track IAM operational metrics and KPIs and reporting.
• Privileged Access Management using Entra PIM.
• Implement Just-In-Time privileged access using Entra PIM.
• Migrate standing access to role-based access via groups.
• Build ServiceNow request workflows for privileged access requests.

Skills

IAM PAM engineering

PIM Privileged Identity Management

Conditional Access

Active Directory

CyberArk

ServiceNow ITSM

PowerShell scripting

Tools

PowerShell

Entra ID

Job description

Senior IAM Engineer to support IAM service transition privileged access transformation and identity security improvements across Entra ID Active Directory CyberArk and ServiceNow The role will drive operational handover strengthen access controls and improve governance across both human and nonhuman identities Capable of critical thinking constructively challenging ideas and working independently to a high standard

Key Responsibilities

• IAM Service Transition Operations
• Support handover of IAM BAU operations into a centralized IAM function
• Define IAM service scope operating model and RACI across support teams
• Drive transition planning resource onboarding and knowledge transfer
• Createupdate SOPs process documentation and operational runbooks
• Configure and optimize ServiceNow groups workflows and ticket routing
• Define and track IAM operational metrics KPIs and reporting
• Privileged Access Management Entra PIM
• Implement JustinTime JIT privileged access using Entra PIM
• Migrate standing access to eligible rolebased access via groups
• Configure approval workflows and Tierbased access controls incl Tier 0
• Implement and manage breakglass accounts with monitoring and controls
• Support access recertification and removal of overpermissioned access
• Define and manage Entraonly privileged account model and lifecycle
• Build ServiceNow request workflows for privileged access requests
• Conditional Access Transformation
• Assess and baseline existing Conditional Access policies and risks
• Redesign into a secure simplified and governed CA model
• Enforce controls including
• oMFA phishingresistant
• ocompliant hybrid joined devices
• oriskbased access controls
• Rationalise exceptions exclusions and service account access
• Support testing phased rollout and governance model implementation
• Identity Security Hygiene
• Implement automated user notification and forced reset mechanisms
• Improve controls to prevent weak passwords going forward
• Strengthen CyberArk policies and privileged session controls
• Prevent direct access bypass of vaulted credentials
• Enhance monitoring and ing for privileged access activity
• Perform account discovery and improve vaulting coverage
• Clean up orphaned invalid and leaverrelated accounts and safes
• Implement processes for ongoing CyberArk hygiene and lifecycle management
• Service Accounts NonHuman Identities NHI
• Review and secure AD service accounts remove unnecessary interactive login
• Assess and govern NHI landscape gMSA certificates secrets etc
• Improve credential storage ownership and lifecycle controls
• Strengthen governance of
• oManaged identities
• oApplication registrations
• Reduce dependency on shared secrets and unmanaged credentials
• Emerging Identity Areas AI Workload Identities
• Assess AI agents and automation workflows for identity risks
• Review access models delegated permissions and data exposure
• Recommend controls for secure and governed agentic access

Required Skills

• Strong handson experience in IAM PAM engineering
• oPIM Privileged Identity Management
• oConditional Access
• oActive Directory AD
• Experience with CyberArk or equivalent PAM tools
• Experience working with ServiceNow ITSM workflows request management
• Good understanding of
• JIT access least privilege
• Identity governance access reviews
• Service accounts nonhuman identities

Good to Have

• Experience in IAM service transition setup
• Exposure to audit compliance and recertification processes
• Knowledge of OAuth certificates workload identity security

Experience

• 6-10 years in IAM Cyber Security
• Strong handson implementation experience required
• IAM IGA Operations Analyst related activities
• 1Perform routine PowerShell based operational scripts for standard reporting data extraction and repeatable IAM housekeeping tasks as per approved runbooks
• 2Execute identity hygiene activities such as user group application and service principal cleanup based on predefined procedures and approval
• 3Support orphaned account identification and remediation activities by running standard reports and executing approved corrective actions
• 4Assist with removal or remediation of legacy authentication methods by executing predefined changes and remediation steps approved by IAM engineering or security team
• 5Provide operational support for SSO MFA and federation platforms including incident handling service requests monitoring and routine maintenance
• 6Implement pre approved authentication and access control policies i