Identity and Access Management (IAM) Security Engineer

Ernst & Young LLP ( EY India ); Bengaluru; On-site; INR 1,800,000 - 3,000,000; Full time

Benefits offered by this job

Continuous learning

Leadership development

Diverse and inclusive culture

Impactful work

Job summary

EY India is seeking an IAM Secure Access Engineer to design, implement and secure authentication across enterprise, cloud and hybrid environments. You will work with Entra ID, PingID, Okta and PlainID to enable trusted access and protect information assets.

Join a global team delivering secure identity solutions, with opportunities to influence security posture, tooling, and incident response while collaborating with Architecture, Product, Operations and vendors.

Qualifications

• Degree in Computer Science, IT, Cybersecurity or related field, or equivalent experience.
• 2–5 years in IAM, authentication engineering or related security role.
• Familiarity with CI/CD tools (Azure DevOps, GitHub Actions, Jenkins, GitLab).

Responsibilities

• Design, configure and support authentication and federation integrations (SAML/OAuth/OpenID Connect).
• Implement MFA, SSO and passwordless authentication.
• Configure PingID, PingFederate, PingAccess, Okta, Entra ID integrations.
• Support onboarding and migration to modern authentication patterns.
• Analyze authentication failures and access issues across platforms.

Skills

IAM fundamentals

SAML 2.0

OAuth 2.0

OpenID Connect

MFA/SSO

PowerShell

REST APIs

Education

Degree in Computer Science/IT/Cybersecurity

Tools

Microsoft Entra ID

PingFederate

Okta

PlainID

Job description

Security Engineer At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all.

IAM Secure Access Engineer

Today's world is fueled by vast amounts of information. Data is more valuable than ever before. Protecting data and information systems is central to doing business, and everyone in EY Information Security has a critical role to play. Join a global team of professionals who collaborate to support the business by protecting information assets. Our Information Security professionals enable the organization to work securely and deliver secure products and services, as well as detect and respond to security events as they happen.

Within Information Security, we blend risk strategy, digital identity, cyber defense, application security and technology solutions across the security lifecycle. You will join a team of security-focused professionals dedicated to supporting, protecting and enabling the business through innovative and secure solutions that provide business value.

The opportunity

As part of the Identity and Access Management organization, the IAM Secure Access Engineer will design, configure, test and implement authentication, federation and authorization capabilities across enterprise, cloud and hybrid environments. The role combines traditional IAM engineering fundamentals with delivery of new Secure Access initiatives across Microsoft Entra ID, Conditional Access, PingID, PingFederate, PingAccess, Okta, PlainID, multifactor authentication, passwordless authentication, workload identities, token protection and secrets or certificate-based authentication.

The engineer will work with Architecture, Product, Operations, application teams and vendors to translate requirements into secure, supportable solutions and move changes through design, build, test, production deployment and operational handover.

Your key responsibilities

Authentication, Federation & Access Engineering

• Design, configure and support authentication and federation integrations using SAML 2.0, OAuth 2.0, OpenID Connect and related standards.
• Implement and maintain MFA, single sign-on, passwordless authentication and risk-based access controls.
• Configure and troubleshoot PingID, PingFederate, PingAccess, Okta and Microsoft Entra ID integrations.
• Support onboarding and migration of applications to modern authentication patterns.
• Analyze authentication failures, policy conflicts, token issues and user access problems across integrated platforms.

Conditional Access & Identity Protection

• Implement and enhance Microsoft Entra Conditional Access policies, authentication strengths, authentication contexts and protected actions.
• Support Continuous Access Evaluation, token protection, sign-in risk controls and secure administrative access patterns.
• Assess policy impact, exclusions, break-glass requirements and deployment risks before production release.
• Use logs and platform telemetry to validate control effectiveness and investigate access issues.

Authorization, Workload Identity & Secrets

• Implement policy-based authorization using PlainID or comparable authorization platforms.
• Support role-based, attribute-based and policy-based access control patterns.
• Improve security for service principals, managed identities, application identities and other non-human identities.
• Support migration from shared secrets to managed identity, certificates or approved vault-based patterns.
• Coordinate certificate, key and secret lifecycle activities with PKI, vault and application teams.

Engineering Delivery & Operations

• Create technical designs, implementation plans, test cases, rollback plans and operational documentation.
• Raise and manage Change Requests and support production deployments through established controls.
• Automate repeatable administration and validation tasks using PowerShell, REST APIs or other approved scripting methods.
• Perform unit, integration, regression and security testing and support post-deployment validation.
• Participate in incident, problem, vulnerability remediation and continual improvement activities.

Skills and attributes for success

• Solid understanding of authentication, authorization, identity federation, MFA, SSO and Zero Trust principles.
• Hands-on experience with at least two of the following: Microsoft Entra ID, PingID, PingFederate, PingAccess, Okta or PlainID.
• Working knowledge of SAML, OAuth 2.0, OpenID Connect, JWT, SCIM, LDAP, Kerberos and RADIUS.
• Experience with Conditional Access, Identity Protection, workload identities or modern authentication controls.
• PowerShell or comparable scripting experience and the ability to work with REST APIs, JSON and certificates.
• Strong troubleshooting, documentation, testing and stakeholder communication skills.
• Understanding of secure software delivery, ITSM, Change Management and production support practices.

To qualify for the role you must have

• Degree in Computer Science, Information Technology, Cybersecurity or a related discipline, or equivalent practical experience.
• 2 to 5 years of experience in IAM, authentication engineering, access management, security engineering or enterprise platform support.
• Familiarity with CI/CD tools such as Azure DevOps, GitHub Actions, Jenkins, or GitLab CI/CD.
• Experience creating deployment pipelines and release automation.
• Basic containerization knowledge (Docker/Kubernetes preferred).
• Experience configuring or supporting enterprise authentication and access management solutions.
• Experience delivering controlled changes across development, test and production environments.Ability to analyze technical issues, document findings and work effectively with distributed teams.
• Ideally, you’ll also have Experience with Microsoft Entra Conditional Access, Ping Identity products, Okta or PlainID.
• Knowledge of passwordless authentication, FIDO2, certificate-based authentication and PKI.
• Experience with CyberArk, Azure Key Vault or another enterprise secrets platform.
• Cloud platform knowledge in Azure and familiarity with CI/CD or infrastructure automation.
• Relevant Microsoft, Ping Identity, Okta, security or ITIL certification.

What we look for

We look for a hands-on engineer who combines sound IAM fundamentals with curiosity about emerging authentication and authorization controls. The successful candidate is structured, security-minded and comfortable collaborating across application, infrastructure, architecture and operations teams.

What we offer

• Continuous learning: You will develop the mindset and skills to navigate whatever comes next.
• Success as defined by you: We will provide the tools and flexibility so you can make a significant impact, your way.
• Transformative leadership: We will give you the insights, coaching and confidence to be the leader the world needs.
• Diverse and inclusive culture: You will be accepted for who you are and empowered to use your voice to help others find theirs.

EY | Building a better working world

EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets. Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate. Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today.