Engineer Sr

TekWissen ®; Seattle (WA); Hybrid; USD 110,000 - 150,000; Full time

Job summary

TekWissen is seeking an Identity Operations Engineer to manage automated identity lifecycles across Microsoft Entra ID, SailPoint ISC, and related platforms. You will handle joiner/mover/leaver provisioning, access requests, and remediation of provisioning failures.

The role emphasizes hands-on operations, troubleshooting, and building automation to reduce repetitive work. You will collaborate with Identity Architecture, HR, ITSM, and Security Operations to improve data quality and enable secure

Qualifications

• 3+ years in identity and access management (IAM)
• Hands-on experience with Microsoft Entra ID
• Experience operating an enterprise IAM platform (SailPoint ISC)
• Proven scripting and automation skills (PowerShell, Graph API)
• Familiarity with ITSM ticketing (ServiceNow) and audits (SOX, PCI)
• Understanding of authentication and provisioning protocols (SAML, OIDC, SCIM)
• Experience with hybrid identity and AD synchronization

Responsibilities

• Manage identity lifecycle requests (joiner/mover/leaver) in ITSM queue within SLA
• Operate SailPoint ISC and troubleshoot provisioning
• Administrate Entra ID users, groups, licenses, and access packages
• Develop automation using PowerShell, Graph API, Python and ISC APIs
• Create event-driven workflows with Azure Automation, Logic Apps, Power Automate
• Collaborate with HR, ITSM, Security to improve data quality and timing
• Contribute to incident response for identity-related issues

Skills

IAM operations

PowerShell

Microsoft Entra ID

SailPoint ISC

Microsoft Graph API

Python

ITSM (ServiceNow)

SOX PCI compliance

Education

BSc/MSc in CS/IT

Tools

SailPoint ISC

Entra ID

Graph PowerShell SDK

Azure Logic Apps

Power Automate

Job description

TekWissen is a global workforce management provider headquartered in Ann Arbor, Michigan that offers strategic talent solutions to our clients world-wide. The below job opportunity is to one of Our clients Who is a fashion specialty retailer founded on a simple idea: offer each customer the best possible service, quality, value, and selection. We are looking for an individual to provide specialized Information Technology support for our strategic business partners within the client Corporate Center.

Job Description:

About the Role:

• Client relies on Microsoft Entra ID and SailPoint Identity Security Cloud (ISC) to manage access for employees, partners, and contractors across a hybrid, multi-cloud environment.
• We're hiring an Identity Operations Engineer to keep that machinery running — resolving joiner, mover, and leaver (JML) requests, access requests, and provisioning issues across our identity platforms — and to build the automation that eliminates repeat work.
• This is a hands‑on operations role, not an architecture role.
• Most of your time is spent working the identity ticket queue, troubleshooting provisioning and sync failures, and executing lifecycle changes accurately and on time.
• The rest is spent finding the tickets and manual steps that shouldn't exist and automating them away with PowerShell, Microsoft Graph, SailPoint ISC APIs, and workflow tooling.
• You'll work closely with Identity Architecture, HR, IT Service Management, application owners, and Security Operations, and you'll be the person the business relies on when access doesn't work the way it should.
• It's a strong fit for an engineer who enjoys solving real access problems for real people and has a bias toward scripting the fix instead of repeating it.

A Day in the Life:

Identity Lifecycle Operations (Joiner / Mover / Leaver):

• Fulfill and resolve joiner, mover, and leaver requests from the ITSM queue within SLA — account creation, baseline and role-based access assignment, access changes for transfers and promotions, and timely, complete deprovisioning for terminations, contractors, and leaves of absence.
• Operate SailPoint ISC day to day — process access requests, investigate and remediate provisioning failures, monitor aggregations and identity refreshes, correct identity attribute and source-data issues, and manage role and access profile assignments.
• Administer Microsoft Entra ID — users, groups (including dynamic membership), license assignment, enterprise application role assignments, guest accounts, and Lifecycle Workflows and Entitlement Management access package requests.
• Troubleshoot HR-to-identity provisioning and hybrid sync issues — attribute mismatches, duplicate or conflicting accounts, and Entra Connect / Cloud Sync errors between Entra ID and on-premises Active Directory.
• Handle privileged and elevated access requests — Privileged Identity Management (PIM) eligible assignments, role-assignable and privileged groups — with the required approvals, justification, and audit trail.
• Support application access — SSO (SAML/OIDC) assignments, SCIM provisioning errors, and onboarding of applications and connectors to established patterns defined by Identity Architecture.
• Run access certification and access review campaigns operationally — launch, monitor, send reminders, and execute revocations — and produce audit evidence for internal and external audits (e.g., SOX, PCI).
• Perform ongoing account hygiene — orphaned, dormant, and stale accounts, guest cleanup, service account inventory, and reconciliation between Entra, SailPoint, and Active Directory.
• Build and maintain automation for lifecycle and access tasks using PowerShell, Microsoft Graph API / Graph PowerShell SDK, Python, and SailPoint ISC APIs, workflows, and rules.
• Create event-driven and scheduled workflows using tools such as Azure Automation, Logic Apps, Power Automate, or Azure Functions — including ITSM ticket integration for auto-fulfillment, status updates, and closure.
• Analyze ticket volume, SLA performance, and recurring failure patterns to identify the highest-value automation opportunities, and track results (tickets eliminated, time saved, error reduction).
• Treat automation as production code — source control, peer review, testing, logging, and error handling — so that scripts and workflows are repeatable, supportable, and safe to run against live identities.
• Use AI tooling to speed up scripting, log and error analysis, troubleshooting, and documentation.

Across the role:

• Write and maintain runbooks, SOPs, and knowledge base articles so that common identity issues can be resolved consistently by the broader support organization.
• Serve as an escalation point for the service desk and application teams, and partner with Identity Architecture to feed operational findings back into design and standards.
• Partner with HR/HRIS, IT Service Management, and Security Operations to improve source-data quality, lifecycle timing, and the identity signals available for threat detection.
• Participate in incident response and escalation coverage for identity-related issues, including after-hours support as needed.

You Own This If You Have:

• Bachelor's or master's degree in Computer Science, Cybersecurity, Information Technology, or equivalent education and experience.
• 3+ years in identity and access management, IAM operations, or systems/security engineering, including hands‑on work with joiner/mover/leaver processes.
• Hands‑on experience with Microsoft Entra ID — user, group, and application administration, plus working knowledge of Conditional Access, PIM, and Entra ID Governance features (Lifecycle Workflows, Entitlement Management, Access Reviews).
• Hands‑on experience operating an enterprise IGA platform — SailPoint ISC / IdentityNow preferred; comparable experience with other IGA tools is considered — including access requests, provisioning, source connectors, and troubleshooting failed provisioning.
• Proven scripting and automation skills — PowerShell and Microsoft Graph API / Graph PowerShell SDK required; Python and REST API integration experience strongly valued.
• Working knowledge of authentication and provisioning protocols — SAML, OAuth 2.0, OIDC, SCIM — sufficient to troubleshoot SSO and provisioning issues.
• Experience with hybrid identity — on-premises Active Directory, Entra Connect / Cloud Sync — and troubleshooting synchronization and attribute issues.
• Experience working in an ITSM ticketing environment (e.g., ServiceNow), managing queues against SLAs, and documenting work to audit standards.
• Strong troubleshooting and problem-solving skills, attention to detail, and clear communication with both technical and non-technical partners.

Nice to Have:

• Certifications: Microsoft SC-300 (Identity and Access Administrator), SailPoint ISC certification, AZ-500, Security+, or CISSP.
• Experience building ITSM-integrated automation (e.g., ServiceNow to SailPoint or Entra fulfillment workflows).
• Experience with low-code/no-code automation (Power Automate, Logic Apps) and infrastructure-as-code or configuration-as-code (Terraform, Bicep).
• Familiarity with HRIS-driven provisioning (e.g., Workday) and source-of-truth data quality issues.
• Familiarity with privileged access management (e.g., BeyondTrust) and how PAM and PIM complement each other.
• Experience supporting audit and compliance requirements (SOX, PCI) for access controls and evidence collection.
• Exposure to identity threat detection and response (ITDR) and feeding identity signals into SIEM/SOAR.
• Large-scale retail, ecommerce, or other high-transaction enterprise experience.

TekWissen Group is an equal opportunity employer supporting workforce diversity.