Chief IAM Engineer

EPAM Systems Inc; United States; Remote; USD 140,000 - 190,000; Full time

Job summary

EPAM Systems seeks a Chief IAM Engineer to lead the technical architecture and hands-on execution of a workforce identity platform migration from Okta Workforce Identity to Microsoft Entra ID.

You will define migration patterns, standardize federation configurations, and ensure parity in identity lifecycle across a large portfolio of applications. Strong leadership, SAML/OIDC mastery, and experience with SAFe are required.

Qualifications

• 7+ years of hands-on identity engineering experience with Okta Workforce Identity and Microsoft Entra ID in production.
• Proven technical leadership experience owning architecture decisions and setting engineering standards for identity platforms.
• Large-scale IdP migration experience re-platforming SAML and OpenID Connect integrations across many applications.
• Advanced SAML expertise including federation setup, claims/attribute mapping, and troubleshooting.
• Advanced OpenID Connect expertise including token and claims design and troubleshooting.
• Strong documentation skills using Atlassian Confluence and work tracking in Atlassian Jira.
• English proficiency Upper-Intermediate (B2) and strong communication to stakeholders.

Responsibilities

• Own the technical architecture and migration strategy for moving Okta Workforce Identity capabilities to Microsoft Entra ID
• Define migration patterns, sequencing, and technical standards for transitioning a large application portfolio from Okta to Entra ID
• Design and validate SAML and OpenID Connect federation configurations, claims mapping, and access policy equivalency
• Lead technical design for retiring the Okta SMS authentication factor and transitioning users to Okta Verify as an interim step
• Serve as the technical escalation point for complex application onboarding and migration issues
• Execute or technically review high-complexity migrations, including non-standard federation and service-to-service flows
• Build and maintain migration runbooks, reference architectures, and reusable configuration templates
• Validate identity lifecycle, provisioning, and conditional access parity before and after cutovers
• Troubleshoot and resolve defects related to federation, token issuance, claims mapping, and authentication failures
• Document technical decisions and configurations in Confluence and track engineering work in Jira

Skills

Okta Workforce Identity

Microsoft Entra ID

Identity architecture

SAML

OpenID Connect

Confluence

Jira

Technical leadership

SAFe

AGILE delivery

Tools

Confluence

Jira

Job description

We are seeking a Chief IAM Engineer to lead the technical architecture and hands-on execution of a workforce identity platform migration from Okta Workforce Identity to Microsoft Entra ID. You will set standards, solve complex migration issues, and partner with delivery and governance stakeholders to drive secure outcomes.

Responsibilities

• Own the technical architecture and migration strategy for moving Okta Workforce Identity capabilities to Microsoft Entra ID
• Define migration patterns, sequencing, and technical standards for transitioning a large application portfolio from Okta to Entra ID
• Design and validate SAML and OpenID Connect federation configurations, claims mapping, and access policy equivalency
• Lead technical design for retiring the Okta SMS authentication factor and transitioning users to Okta Verify as an interim step
• Serve as the technical escalation point for complex application onboarding and migration issues
• Execute or technically review high-complexity migrations, including non-standard federation and service-to-service flows
• Build and maintain migration runbooks, reference architectures, and reusable configuration templates
• Validate identity lifecycle, provisioning, and conditional access parity before and after cutovers
• Troubleshoot and resolve defects related to federation, token issuance, claims mapping, and authentication failures
• Partner with the Technical Project Manager on technical scoping, sequencing, and risk input without owning program deliverables
• Document technical decisions and configurations in Confluence and track engineering work in Jira

Requirements

• 7+ years of hands-on identity engineering experience with Okta Workforce Identity and Microsoft Entra ID in production
• Proven technical leadership experience owning architecture decisions and setting engineering standards for identity platforms
• Large-scale IdP migration experience re-platforming SAML and OpenID Connect integrations across many applications
• Advanced SAML expertise including federation setup, claims/attribute mapping, and troubleshooting
• Advanced OpenID Connect expertise including token and claims design and troubleshooting
• Strong documentation skills using Atlassian Confluence and work tracking in Atlassian Jira
• English proficiency Upper-Intermediate (B2)
• Strong communication skills explaining technical trade-offs and risks to engineering and non-technical stakeholders
• Nice to have Agile delivery experience supporting iterative planning and execution
• Privileged Access Management (PAM) experience understanding identity dependencies
• Scaled Agile Framework experience working within SAFe cadences