Cloud IAM Engineer - Federation & Entitlement Architect

GuideWell; Northern (KY); Hybrid; USD 109,000 - 178,000; Full time

Benefits offered by this job

Hybrid work arrangement

Competitive pay

Comprehensive benefits

Retirement Savings Plan with employer

Paid time off and holidays

Job summary

GuideWell is seeking an IAM Engineer to own the cloud side of enterprise identity integration across AWS GovCloud and commercial partitions. You will design federation, automate joiner/mover/leaver processes, and implement workload identity patterns with OIDC for pipelines, while aligning with governance standards.

You will collaborate with application teams to onboard apps to SSO and produce audit-ready evidence, with a focus on cross-account access, security controls, and lifecycle automation

Qualifications

• 6+ years related work experience in IAM, security, or platform engineering, with 3+ years focused on cloud identity.
• Related Bachelor's degree required.
• Strong AWS/Azure IAM skills, including cross-account access, federation, and permission boundaries.
• Hands-on experience with SSO and federation platforms.
• Experience integrating an enterprise identity provider such as Okta, Entra ID, or Ping with cloud.
• Hands-on Terraform.
• Working knowledge of SAML, OIDC, and SCIM.
• Experience in environments governed by HIPAA, HITRUST, SOC 2, FedRAMP, or NIST 800-53.
• Required to obtain CISSP within 180 Days of hire

Responsibilities

• Design and operate federation and the entitlement model across accounts.
• Automate access lifecycle: joiner, mover, leaver.
• Build workload identity patterns; eliminate long-lived keys and standing access.
• Build access recertification and produce audit evidence.
• Onboard applications to SSO and review access designs with application teams.
• Integrate cloud entitlements with the enterprise identity governance platform.
• Design workload and machine identity patterns, including roles for services and OIDC for pipelines.

Skills

AWS IAM

Azure IAM

SSO

federation

Terraform

SAML/OIDC/SCIM

Okta Entra Ping

SailPoint Saviynt

CyberArk

Python scripting

Education

Bachelor's degree

Tools

Okta

Entra ID

Ping Identity

SailPoint

Saviynt

CyberArk

Job description

GuideWell is seeking an IAM Engineer to own the cloud side of enterprise identity integration across AWS GovCloud and commercial partitions. You will design federation, automate joiner/mover/leaver processes, and implement workload identity patterns with OIDC for pipelines, while aligning with governance standards.

You will collaborate with application teams to onboard apps to SSO and produce audit-ready evidence, with a focus on cross-account access, security controls, and lifecycle automation