Identity and Access Management Engineer

SP Software; Bengaluru; On-site; INR 2,500,000 - 4,000,000; Full time

Job summary

SP Software is seeking an experienced IAM engineer to design, implement, and manage identity and access management across cloud and on-prem environments. You will work with protocols like SAML, OAuth, and OpenID Connect and deploy platforms such as Okta and Azure Entra ID.

You will handle AWS, Azure, and GCP IAM configurations, including roles, SCPs, conditional access, and auditing controls, ensuring secure access and compliance.

Qualifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field, or equivalent experience.
• Minimum of 5 years of experience engineering IAM solutions across authentication, federation, access control, lifecycle management, access governance, or related identity domains.
• Demonstrable experience operating IAM capabilities across enterprise environments, including public cloud and on-premises systems.
• Deep understanding of identity and authentication protocols such as SAML, OAuth, OpenID Connect, LDAP, Kerberos, and SCIM.
• Experience with enterprise identity platforms such as Okta, Microsoft Entra ID, Ping, SailPoint, Saviynt, CyberArk, or similar technologies.
• Strong hands-on experience with cloud IAM across at least two of AWS, Azure, GCP.

Skills

IAM engineering

Authentication protocols

SAML/OAuth/OIDC

LDAP/Kerberos/SCIM

IAM platforms

Cloud IAM

AWS IAM

Azure IAM

GCP IAM

Education

Bachelor's degree in CS/IT/Cybersecurity or related field

Tools

Okta

Microsoft Entra ID

Ping

SailPoint

Saviynt

CyberArk

Job description

Role & responsibilities

Bachelors degree in Computer Science, Information Technology, Cybersecurity, or a related field, or equivalent experience

A minimum of 5 years of experience engineering identity and access management solutions across authentication, federation, access control, lifecycle management, access governance, or related identity domains

Demonstrable experience operating and maintaining IAM capabilities across enterprise environments, including public cloud and on-premises systems

Deep understanding of identity and authentication protocols such as SAML, OAuth, OpenID Connect, LDAP, Kerberos, and SCIM

Experience with enterprise identity platforms such as Okta, Microsoft Entra ID, Ping, SailPoint, Saviynt, CyberArk, or similar technologies

Strong hands-on experience with cloud IAM across at least two of:

• AWS
• Azure
• GCP

AWS IAM

• IAM users, groups, roles, and policies (identity-based, resource-based, permission boundaries)
• Service Control Policies (SCPs) and AWS Organizations
• AWS Control Tower, account factory, and landing zone concepts
• Cross-account access, role assumption, and external ID patterns
• AWS SSO / IAM Identity Center
• Service-linked roles and service accounts
• CloudTrail, Config Rules, and Access Analyzer for IAM auditing

Azure IAM

• Azure Active Directory / Microsoft Entra ID users, groups, roles, administrative units
• Role-based access control (RBAC) built-in and custom role definitions
• Service principals, managed identities (system-assigned and user-assigned)
• App registrations, federated credentials, and workload identity federation
• Conditional Access policies, Privileged Identity Management (PIM)
• Management groups, subscriptions, and resource group scoping
• Azure Key Vault access policies and RBAC

GCP IAM

• IAM roles (basic, predefined, custom) and policy bindings
• Service accounts creation, key management, impersonation, short-lived credentials
• Workload Identity and Workload Identity Federation
• Organization policies, folders, and project-level IAM
• GKE IAM - Kubernetes RBAC integration, namespace-level bindings
• Cloud Asset Inventory and Policy Analyzer for access auditing
• VPC Service Controls and access context