AI-Augmented IAM Security Engineer

EPAM Systems; Poland; Hybrid; PLN 180,000 - 270,000; Full time

Benefits offered by this job

Hybrid by design

Remote within Poland

Relocation opportunities

Health insurance

Multisport

Shopping vouchers

Referral bonuses

Job summary

EPAM Systems is seeking an AI-Augmented IAM Security Engineer to hands-on implement, configure and automate enterprise IAM. You will run provisioning, SSO, MFA, and access governance, while integrating AI-assisted automations into IAM pipelines in a delivery-and-operations context.

Join a team that builds and troubleshoots IAM across cloud platforms and enterprise systems, applying industry standards and security leadership guidance in a hybrid Poland-based role.

Qualifications

• Bachelor's degree or equivalent practical experience.
• 2+ years hands-on IAM implementation or operations experience.
• Experience with at least one IAM/IGA/PAM platform and federation.
• Understanding of SSO, MFA, RBAC/ABAC and least-privilege access.
• Knowledge of SAML, OAuth2, OIDC, SCIM, LDAP and Kerberos.
• Cloud IAM experience on Azure, AWS or GCP.
• Scripting and automation with PowerShell, Python, Bash or REST APIs.
• Ability to work with developers, architects and security teams.
• Awareness of AI-assisted automation and secure AI tooling.

Responsibilities

• Implement, configure and operate IAM solutions per architecture and standards.
• Maintain identity lifecycle processes including automated provisioning/deprovisioning.
• Configure core IAM capabilities: SSO, MFA, passwordless, conditional access.
• Develop IAM integrations with cloud platforms, SaaS apps, directories and APIs.
• Execute access reviews, SoD rules and entitlement clean-up.
• Operate Privileged Access Management controls and vaults.
• Develop automation scripts and tooling using PowerShell, Python, REST or Terraform.
• Monitor IAM health, troubleshoot incidents and perform patching and hardening.
• Maintain logging, alerts and runbooks; support audits and governance.

Skills

Identity and Access Management

Scripting and automation

PowerShell

Python

REST APIs

SCIM

Terraform

RBAC/ABAC concepts

Cloud IAM (Azure/AWS/GCP)

AI-assisted automation

Education

Bachelor's degree in Computer Science or related field

Tools

Microsoft Entra ID

Okta

SailPoint

CyberArk

Job description

We are seeking an AI-Augmented IAM Security Engineer to handle the hands‑on implementation, configuration, automation and day‑to‑day operation of enterprise Identity and Access Management. This is a delivery-and-operations role that works within the designs, standards, role models and policies set by IAM architects and security leadership. The focus is building, configuring, scripting, running and troubleshooting IAM, not defining target‑state architecture, role models or governance policy.

Responsibilities

• Implement, configure and operate IAM solutions and controls based on architecture, standards and designs defined by IAM architects and security leadership
• Maintain identity lifecycle (Joiner / Mover / Leaver) processes, including automated provisioning and deprovisioning across target systems
• Configure core IAM capabilities, including SSO, federation, MFA and passwordless authentication, conditional access, RBAC/ABAC role models and least‑privilege access
• Develop and deploy IAM integrations and connectors with cloud platforms, SaaS applications, enterprise systems, directories, authoritative source systems, databases and APIs
• Execute access certification and review campaigns, perform entitlement clean‑up and configure segregation‑of‑duties (SoD) rules according to access policies defined by architects and the business
• Operate Privileged Access Management controls, including credential vaulting, secrets rotation, session management and just‑in‑time and just‑enough access
• Develop automation scripts, workflows and IAM tooling using PowerShell, Python, REST APIs, SCIM, Terraform or similar technologies
• Monitor IAM platform health, troubleshoot and resolve incidents and access issues, and perform patching, upgrades and configuration hardening
• Maintain IAM logging, alerting and monitoring, and run backup and recovery procedures according to defined runbooks and resilience requirements
• Deploy AI‑assisted automations and agentic workflows that reduce manual effort across daily IAM operations, such as access request triage, entitlement analysis, anomaly detection, root‑cause analysis, privileged access review support, compliance evidence collection and documentation generation
• Integrate AI agents and LLM‑backed automations into IAM systems and operational pipelines, connecting models to internal tools, APIs, directories, ticketing and IAM platforms via function calling, SCIM, REST and webhooks
• Develop and maintain reusable prompts, structured‑prompting patterns and prompt templates, and implement retrieval over IAM policies, role catalogs, runbooks and documentation (for example RAG) so AI assistants answer from current authoritative internal sources
• Implement output verification, human‑in‑the‑loop approval gates and rollback paths in AI‑assisted IAM workflows, so no AI‑driven change reaches production access without review
• Implement security and privacy controls for IAM AI usage, including least‑privilege access for agents, secrets and credential handling, prompt‑injection resistance, redaction of sensitive identity data and full auditability of AI‑driven actions
• Monitor AI‑assisted IAM automations in production, measure their accuracy and impact, continuously tune prompts, tools and workflows, and produce operational documentation, runbooks and standard operating procedures while supporting audits and compliance evidence requests

Requirements

• Bachelor's degree in Computer Science, Cybersecurity, Engineering or equivalent practical experience
• 2+ years of hands‑on experience implementing or operating Identity and Access Management solutions
• Experience with at least one enterprise IAM, IGA, PAM or federation platform
• Understanding of IAM concepts, including identity lifecycle, authentication and authorization, SSO, federation, MFA, RBAC/ABAC, least privilege and privileged access
• Knowledge of common IAM protocols and standards such as SAML, OAuth 2.0 and OpenID Connect, alongside SCIM, LDAP and Kerberos
• Experience configuring IAM controls, policies, connectors and access governance workflows
• Working knowledge of cloud IAM concepts across at least one major cloud platform such as Azure, AWS or GCP
• Scripting and automation experience using at least one of PowerShell, Python, Bash, REST APIs, SCIM or Terraform
• Capability to work closely with developers, architects, infrastructure engineers, security operations, compliance teams and business stakeholders
• Competency to follow, maintain and improve defined IAM and security processes, executing changes from tickets, runbooks and designs while escalating design‑level questions
• Practical understanding of AI‑assisted productivity and automation beyond basic chatbot usage, including building AI agents, automating repetitive IAM tasks, integrating LLMs with tools and documents, prompt engineering and using AI tools securely with awareness of sensitive identity data
• Good communication skills and the ability to explain IAM issues, technical decisions and remediation steps to both technical and non‑technical stakeholders

Nice to have

• Familiarity with IAM platforms such as Microsoft Entra ID, Active Directory and Okta, alongside Ping Identity, ForgeRock, Auth0, SailPoint, Saviynt or CyberArk
• Experience with CIAM, B2B/B2C identity, customer identity, external identity or partner access scenarios, plus SIEM/SOAR integrations for IAM monitoring, alerting and automated response
• Experience with CI/CD‑based IAM deployment, configuration‑as‑code and automated testing of IAM changes
• Familiarity with AI/LLM platforms or frameworks such as Azure OpenAI, Amazon Bedrock and Microsoft Copilot Studio, alongside LangChain, AutoGen or Power Automate
• Understanding of AI security risks, including data leakage, prompt injection, excessive agency, insecure tool use, model governance and sensitive identity data exposure
• SC-300, Okta Certified Professional / Administrator / Consultant, SailPoint, Saviynt, CyberArk or Ping Identity certifications, CISSP, CISM, CISA, CCSK, CCSP, SSCP, AI-900 or AWS Certified AI Practitioner

We offer

• We gather like‑minded people:
  • Top tech minds driving innovation in AI, cloud and digital platform modernization
  • Supportive team and an agile, startup‑like culture
  • Hybrid by design mode and opportunity to work remotely within Poland
  • Chance to work abroad for up to 60 days annually
  • Business‑driven relocation opportunities
• We provide growth opportunities:
  • Career development programs
  • Thought leadership, mentoring, soft skills and well‑being programs
  • Certification (Anthropic, Gemini, GCP, Azure, AWS)
  • English classes
• We cover it all:
  • Stable pay
  • Participation in the Employee Stock Purchase Plan with a 15% discount
  • Benefits package (health insurance, multisport, shopping vouchers)
  • Referral bonuses up to $2,000
  • Offices featuring entertainment and relaxation zones, table tennis and football, free snacks, coffee and more
  • Corporate, social and well‑being events
• Please, note:
  • We will reach out to selected candidates exclusively

EPAM is global leader in AI transformation engineering and integrated consulting, serving Forbes Global 2000 companies and ambitious startups. With over thirty years of expertise in custom software, product and platform engineering, we empower our clients to become AI‑Native enterprises, driving measurable value from innovation and digital investments.