Cloud IAM Architect: Federation & Entitlements

Florida Blue Group; Northern (KY); Hybrid; USD 109,000 - 178,000; Full time

Benefits offered by this job

Medical, dental, vision

Retirement plan with employer match

Paid time off

Public holidays

Long/Short-term disability

Wellness program

Job summary

GuideWell is migrating to AWS across commercial and GovCloud partitions. The IAM Engineer owns how identity works in that environment: federation from the enterprise identity provider, access lifecycle into cloud accounts, and the authorization model application teams build against.

The role emphasizes workload identity patterns, automating joiner/mover/leaver, and ensuring auditable, secure access across HIPAA/NIST controls.

Qualifications

• 6+ years in IAM, security, or platform engineering with 3+ years cloud identity.
• Bachelor's degree required.
• Strong AWS/Azure IAM: cross-account access, federation, and permission boundaries.
• Hands-on with SSO and federation platforms.
• Experience integrating enterprise IdP (Okta/Entra ID/Ping) with cloud.
• Hands-on Terraform.
• Knowledge of SAML, OIDC, SCIM.
• Experience in HIPAA/HITRUST/SOC 2/FedRAMP/NIST 800-53.
• CISSP certification within 180 days of hire.

Responsibilities

• Design and operate federation and entitlement model across accounts.
• Automate access lifecycle: joiner, mover, leaver.
• Build workload identity patterns and eliminate long-lived keys.
• Build access recertification and audit evidence.
• Onboard applications to SSO and review access designs.
• Integrate cloud entitlements with enterprise identity governance.
• Design machine identity patterns including OIDC for pipelines.

Skills

IAM experience

Cloud identity

SAML

OIDC

SCIM

Terraform

SSO

HIPAA/HITRUST/SOC 2/FedRAMP/NIST

CISSP

Identity governance

Education

Bachelor's degree

Tools

Okta

Entra ID

Ping

SailPoint

Saviynt

CyberArk

Job description

GuideWell is migrating to AWS across commercial and GovCloud partitions. The IAM Engineer owns how identity works in that environment: federation from the enterprise identity provider, access lifecycle into cloud accounts, and the authorization model application teams build against.

The role emphasizes workload identity patterns, automating joiner/mover/leaver, and ensuring auditable, secure access across HIPAA/NIST controls.