IAM Engineer I, II, III, or Senior

Tri-State Generation and Transmission Association, Inc.; City of Westminster; Hybrid; GBP 61,000 - 106,000; Full time

Benefits offered by this job

Medical Insurance

Dental Insurance

Vision Insurance

Health Savings Account (HSA)

Flexible Spending Accounts (FSA)

Tuition Reimbursement

Flexible Work Schedules including tele

Telecommuting up to 40%

Life Insurance

401K

Long Term Disability (LTD)

Short Term Disability (STD)

Employee Assistance Program (EAP)

Job summary

Tri-State Generation and Transmission Association, Inc. is seeking a Senior IAM Engineer to own the most complex, cross‑functional IAM work across on‑prem and cloud environments.

You will define architecture, standards, and runbooks, while mentoring IAM engineers and driving automated identity lifecycle initiatives. The role partners with HR, infrastructure, cybersecurity, and compliance teams to enforce least privilege and support audits.

Qualifications

• Eight or more years of IAM engineering experience in a regulated environment.
• Expert-level design and operation of IAM across IGA, SSO, MFA, PAM, and PKI.
• Experience defining IAM architecture, standards, and roadmaps.
• Microsoft Entra and cloud/hybrid identity experience preferred.

Responsibilities

• Own the most complex IAM work end-to-end.
• Hands-on in engineering, configuring, and troubleshooting IAM platforms.
• Define IAM architecture, standards, and runbooks across IAM domains.
• Develop and drive the IAM technical roadmap with Cybersecurity Risk Manager.
• Define Tri-State’s PAM strategy, including just-in-time elevation.
• Lead enterprise identity architecture design for hybrid environments.
• Mentor IAM Engineers I-III through coaching and reviews.
• Evaluate IAM products, run PoCs, and review vendor statements of work.
• Collaborate with HR, infrastructure, and leadership to define access requirements.

Skills

IAM engineering

Hybrid identity

Scripting - PowerShell

Scripting - Python

API integration

Regulatory compliance

Education

Bachelor’s degree in cybersecurity or related field

Tools

SailPoint IdentityIQ

Microsoft Entra ID

OCI IAM

Delinea Secret Server (PAM)

Active Directory / AD Security

PIM (Privileged Identity Management)

Job description

Job Description

The IAM Engineer is responsible for engineering, operating, and continuously improving Tri‑State’s identity and access management (IAM) capabilities so that the right people and systems have the right access to the right resources, at the right time, for only as long as needed. The position supports the full identity lifecycle (joiner, mover, and leaver) for employees, contractors, and non‑human identities such as service accounts across on‑premises and cloud environments. Core capabilities include directory services, identity governance and administration (IGA) and access certification, single sign‑on (SSO), multifactor authentication (MFA) and conditional access, privileged access management (PAM) including just‑in‑time (JIT) elevation, and public key infrastructure (PKI) and certificate services. The IAM Engineer partners with Human Resources, application owners, infrastructure, cybersecurity, and compliance teams to enforce least privilege, automate identity processes, support regulatory and audit requirements, and deliver secure, reliable access to Tri‑State’s business and operational systems.

Job Description

The IAM Engineer is responsible for engineering, operating, and continuously improving Tri‑State’s identity and access management (IAM) capabilities so that the right people and systems have the right access to the right resources, at the right time, for only as long as needed. The position supports the full identity lifecycle (joiner, mover, and leaver) for employees, contractors, and non‑human identities such as service accounts across on‑premises and cloud environments. Core capabilities include directory services, identity governance and administration (IGA) and access certification, single sign‑on (SSO), multifactor authentication (MFA) and conditional access, privileged access management (PAM) including just‑in‑time (JIT) elevation, and public key infrastructure (PKI) and certificate services. The IAM Engineer partners with Human Resources, application owners, infrastructure, cybersecurity, and compliance teams to enforce least privilege, automate identity processes, support regulatory and audit requirements, and deliver secure, reliable access to Tri‑State’s business and operational systems. At the Senior level, the incumbent is a force multiplier whose impact extends beyond their own deliverables: owns the most complex, cross‑functional, and highest‑risk IAM work; defines IAM architecture, standards, and patterns where none exist; and actively mentors and develops IAM Engineers I through III. Those with less experience will be hired at the IAM Engineer I, II, or III grade level as appropriate. Note There is one position available and the position will be filled at one of four job grade levels: IAM Engineer I, job grade 7; IAM Engineer II, job grade 8, IAM Engineer III, job grade 9; or Senior IAM Engineer, job grade 10. This decision will be based on the qualifications and experience of the candidate selected, and Tri‑State business needs at the time of hire.

Tri‑State recognizes the value of a highly‑engaged and committed workforce and provides an excellent benefits program that includes:

• Medical Insurance
• Dental Insurance
• Vision Insurance
• Health Savings Account (HSA)
• Flexible Spending Accounts (FSA)
• Tuition Reimbursement
• Flexible Work Schedules including compressed work week and telecommuting opportunities to work remotely up to 40%
• Life Insurance
• 401K
• Long Term Disability (LTD)
• Short Term Disability (STD)
• Employee Assistant Program (EAP) and Paid Leave Benefits

Senior IAM Engineer

Hiring Salary Range: $113,000-143,000

IAM Engineer III

Hiring Salary Range: $101,000-$128,000

IAM Engineer II

Hiring Salary Range: $91,000-$114,000

IAM Engineer I

Hiring Salary Range: $82,000-$102,000

Actual compensation offer to candidate may vary outside of the posted hiring salary range based upon work experience, education, and/or skill level.

Responsibilities

• Own the most complex, cross‑functional, and highest‑risk IAM work end-to-end, defining the approach where one does not yet exist.
• Remain hands‑on in engineering, configuring, and troubleshooting IAM platforms, particularly for complex or high‑risk changes.
• Define and maintain IAM architecture, technical standards, design patterns, and runbooks across directory services, identity governance and administration (IGA), single sign‑on (SSO), multifactor authentication (MFA), privileged access management (PAM), and public key infrastructure (PKI).
• Develop and drive the IAM technical roadmap in partnership with the Cybersecurity Risk Manager, including platform modernization, identity source consolidation, and automation of identity lifecycle processes.
• Define Tri‑State’s privileged access strategy, including just‑in‑time elevation, separation of administrative accounts, and elimination of standing privilege.
• Define security role architecture and access governance standards for enterprise SaaS and ERP applications (e.g., Oracle Cloud), including role design, segregation of duties, and controls over privileged, support, and impersonation access.
• Lead the design of enterprise identity architecture, including hybrid on‑premises and cloud identity, authoritative identity sources, and integration patterns for business and operational systems.
• Define Active Directory and hybrid identity security architecture, including administrative tiering and domain controller and Group Policy security baselines, and role‑based access models for cloud platforms (e.g., Microsoft Azure, Oracle Cloud Infrastructure).
• Serve as the senior technical authority and final escalation point for IAM issues, and lead the technical response to identity‑related incidents.
• Set the bar for and review the technical quality of IAM configurations, scripts, integrations, and documentation produced by the team.
• Actively mentor and develop IAM Engineers I through III through coaching, design and code reviews, cross‑training, and stretch assignments.
• Evaluate IAM products and vendors; define requirements and lead technical evaluations, proofs of concept, and RFP reviews; and provide technical input on vendor statements of work.
• Assess IAM‑related risks and control gaps, recommend and drive remediation, and present findings and solutions to IT leadership.
• Lead IAM’s technical role in internal and external audits and regulatory compliance activities, designing controls that are sustainable and auditable.
• Partner with application owners, Human Resources, infrastructure, operational technology, and business leaders to define access requirements and IAM service boundaries, and independently lead working sessions with senior leadership.
• Identify gaps in IAM processes, tooling, and capabilities and drive improvements that make IAM services more automated, reliable, and scalable.
• Ensure IAM disaster recovery, redundancy, and resilience plans are designed, tested, and maintained.
• Maintain compliance with all company policies and procedures and attain knowledge and remain knowledgeable of regulations, laws, standards, and best practices applicable to functional area.
• Because Tri‑State has an obligation to provide continuous, reliable electric service to its customers, the ability to work overtime at any time of the day or week is considered an essential function of the job.

Qualifications

Education and Training

• Bachelor’s degree in cybersecurity, computer science, information technology, information security, information assurance, or a related field, or equivalent work experience.

Experience

• Eight (8) or more years of experience in identity and access management engineering or a related field for IAM Engineer Senior.
• Expert‑level experience designing, implementing, and operating enterprise IAM solutions across identity governance and administration (IGA), directory services, SSO/federation, MFA and conditional access, privileged access management (PAM), and PKI/certificate services.
• Demonstrated experience defining IAM architecture, technical standards, and multi‑year roadmaps.
• Expert knowledge of hybrid identity architectures and identity protocols and standards (e.g., SAML, OAuth 2.0, OpenID Connect, SCIM, Kerberos, LDAP).
• Experience leading complex, cross‑functional IAM projects and vendor engagements from requirements through implementation.
• Demonstrated experience mentoring and developing other engineers.
• Experience designing controls and leading IAM’s role in audits and regulatory compliance in a regulated environment.
• Advanced proficiency in scripting, automation, and API integration (e.g., PowerShell, Python, REST APIs).
• Strong written and verbal communication skills, including presenting risks and recommendations to IT leadership.
• Experience working in fast paced environments and ability to manage workload even during times of stress or escalated activity.
• Those with less experience will be hired at the IAM Engineer I, II, or III grade level as appropriate.

Other

• Willingness to travel as needed (approximately 15% of the time).
• Must possess a valid driver’s license.
• Willingness to work on‑call duty as assigned.
• Must successfully complete and maintain a NERC CIP personnel risk assessment (background check) and required NERC CIP training prior to being granted access to NERC CIP‑protected systems and information.

Desired Job Qualifications

• One or more industry certifications preferred:
• Certified Information Systems Security Professional (CISSP)
• Certified Identity and Access Manager (CIAM) or Certified Identity Management Professional (CIMP)
• Microsoft Certified: Identity and Access Administrator Associate (SC-300)
• SailPoint IdentityIQ certification
• Experience with SailPoint IdentityIQ or another enterprise identity governance and administration (IGA) platform.
• Experience with Microsoft Entra ID (including conditional access) in a hybrid Active Directory environment.
• Experience with Oracle Cloud (Fusion) security, Oracle Cloud Infrastructure (OCI) IAM, or Oracle identity integrations.
• Experience with Delinea Secret Server or another privileged access management (PAM) solution.
• Experience with Microsoft Entra Privileged Identity Management (PIM) or other just‑in‑time privileged access solutions.
• Experience with certificate lifecycle management (CLM) platforms and certificate automation (e.g., ACME, SCEP/NDES, EST), Microsoft Active Directory Certificate Services, and hardware security modules (HSMs).
• Experience using AI‑assisted tools to automate IAM engineering, scripting, and documentation in accordance with company security and data protection guidelines, and familiarity with securing access for AI applications and agents.
• Experience in Sarbanes‑Oxley (SOX) and North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) compliance.
• Experience working within a utility or energy sector.
• An MS, MBA, or related advanced degree desired.

About Us

Tri‑State is a wholesale power supply cooperative, operating on a not‑for‑profit basis, with electric distribution cooperatives and public power district members in four states: Colorado, Nebraska, New Mexico and Wyoming. Together with its members, Tri‑State delivers reliable, affordable and responsible power and energy services to nearly a million electricity consumers across roughly 200,000 square miles of the West. Founded in 1952 by its member systems to provide a reliable, cost‑based supply of electricity, Tri‑State is now headquartered in Westminster, Colo., employing approximately 1,000 people across five states. Tri‑State's electricity is generated from coal, natural gas, hydropower, wind, and solar. This power reaches members via a transmission system that includes substation facilities, telecommunications sites and almost 6,000 miles of high voltage transmission lines. As a member‑owned and‑governed cooperative, every member has a voice and an equal vote in the future of Tri‑State.

Job Identification: 766

Job Category: Cyber Security

Posting Date: 2026-11-04T17:49:37+00:00

Job Schedule: Full time

Hiring Salary Range: $82,000-$143,000

Locations: 1100 W 116th Ave, Westminster, CO, 80234, US

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status.