Engineering Manager - Identity and Access Management

Career Techniques; Dallas (TX); Hybrid; USD 170,000 - 210,000; Full time

Job summary

Career Techniques seeks an Engineering Manager, Identity and Access Management, to translate a broad IAM architecture into an executable roadmap and to build a high-performing team. You will mature Entra ID as the governed identity hub, automate joiner/mover/leaver workflows, and advance phishing-resistant authentication and access governance to protect multi-cloud environments.

You will lead a team across workforce, privileged, workload, and federated identity, while partnering with Platform

Qualifications

• 6+ years of experience in identity and access management, security engineering, platform security, or a closely related field.
• 2+ years of people-management or formal engineering-leadership experience.
• Deep expertise in at least one major identity domain (workforce IAM, identity governance, privileged access, workload identity, PKI, or cloud federation).
• Strong experience with Microsoft Entra ID or comparable enterprise identity platform.
• Experience setting a technical roadmap and delivering production identity capabilities.
• Knowledge of OAuth 2.0, OpenID Connect, SAML, SCIM, X.509, and mutual TLS.

Responsibilities

• Recruit, lead, and develop a team of IAM engineers with clear ownership and on-call practices.
• Own the IAM strategy, phased roadmap, and delivery outcomes across workforce, privileged, workload, and federated identity.
• Lead workforce identity programs including identity lifecycle automation, Conditional Access, phishing-resistant authentication, and access governance.
• Define technical direction for workload and service identity, PKI, and certificate lifecycle management across Kubernetes, bare-metal, and cloud environments.
• Establish Zero Standing Privilege for administrative access, including just-in-time elevation and break-glass paths.
• Guide identity federation and token-service design across tenants and cloud platforms with secure issuer trust and token lifetimes.

Skills

IAM

Microsoft Entra ID

Kubernetes

OpenID Connect

PKI

Education

CISSP

Tools

Terraform

Job description

As the Engineering Manager, Identity and Access Management, you will turn a broad identity architecture into an executable, phased roadmap and build the team that delivers it. Near-term priorities include maturing Microsoft Entra ID as the governed identity hub, automating joiner, mover, and leaver workflows, implementing phishing-resistant authentication and access governance, and establishing resilient privileged-access controls. You will also guide the evolution of workload identity, certificate lifecycle management, service-to-service trust, token exchange, and multi-cloud federation in partnership with Platform Engineering and Infrastructure teams.

Responsibilities

• Recruit, lead, and develop a team of IAM engineers, establishing clear ownership, sustainable on-call practices, and growth plans that build both enterprise and machine-identity capability.
• Own the IAM strategy, phased roadmap, and delivery outcomes across workforce, privileged, workload, and federated identity, sequencing research, proofs of concept, production implementation, and hardening work around explicit dependencies and risks.
• Lead the workforce identity program across Microsoft Entra ID and connected systems, including identity lifecycle automation, Conditional Access, phishing-resistant authentication, role and entitlement design, separation of duties, Privileged Identity Management, and access recertification.
• Set technical direction for workload and service identity, PKI, certificate lifecycle management, and mutual TLS, partnering with platform teams to establish scalable trust patterns for Kubernetes, bare-metal, network, and cloud environments.
• Establish a Zero Standing Privilege operating model for administrative access, including just-in-time elevation, approval controls, recorded sessions, break-glass paths, and periodic validation of privileged-access boundaries.
• Guide identity federation and token-service design across tenants and cloud platforms, ensuring issuer trust, claims, token lifetimes, key rotation, local validation, and revocation are secure, interoperable, and resilient.
• Make identity infrastructure reviewable and repeatable through declarative configuration, GitOps workflows, automated testing, drift detection, and evidence-producing controls rather than manual console changes.
• Define and track service outcomes for availability, provisioning and revocation time, certificate and key rotation, policy convergence, audit coverage, and recovery readiness; ensure runbooks and failure-mode exercises validate those outcomes.
• Partner with Platform Engineering, Cloud, Network, Security Operations, Governance, Risk and Compliance, and external service owners to define clear boundaries, resolve cross-team dependencies, and embed identity controls into platform delivery.
• Translate architecture trade-offs, operational risk, investment needs, and program progress into clear decisions and measurable reporting for technical and executive stakeholders.

Requirements

• 6+ years of experience in identity and access management, security engineering, platform security, or a closely related field, including ownership of production identity capabilities.
• 2+ years of people-management or formal engineering-leadership experience, with evidence of hiring, developing, and retaining engineers and improving team delivery.
• Deep expertise in at least one major identity domain, such as workforce IAM, identity governance, privileged access, workload identity, PKI, or cloud federation, with working knowledge of the adjacent domains.
• Strong experience with Microsoft Entra ID or a comparable enterprise identity platform, including authentication policy, lifecycle management, federation, privileged access, or access governance.
• Experience setting a technical roadmap, prioritizing across competing risks and dependencies, and moving identity capabilities from design or proof of concept into reliable production operation.
• Practical understanding of modern identity and federation standards such as OAuth 2.0, OpenID Connect, SAML, SCIM, X.509, and mutual TLS, with the judgment to apply them securely in distributed systems.
• Experience using automation, infrastructure as code, APIs, or Git-based delivery practices to manage security or identity configuration at scale.
• Demonstrated operational judgment in areas such as incident response, break-glass access, key or credential rotation, disaster recovery, monitoring, and control validation.
• Ability to communicate complex technical decisions and risks clearly, influence partner teams without direct authority, and create alignment among engineering, security, compliance, and leadership stakeholders.

Preferred

• Experience with SPIFFE/SPIRE, Kubernetes workload identity, service meshes, or other patterns for issuing short-lived workload credentials.
• Experience designing or operating PKI and certificate lifecycle platforms, including step-ca, hardware security modules, ACME, trust-bundle distribution, or certificate revocation.
• Familiarity with privileged-access and secrets platforms such as Teleport, HashiCorp Vault, or equivalent technologies.
• Experience with identity federation across Azure, AWS, or Google Cloud, including workload identity federation, IAM Identity Center, attribute-based access control, or token exchange.
• Background in HPC, multi-tenant platforms, regulated environments, or systems designed to continue operating through cloud or internet outages.
• Relevant certifications such as CISSP, CISM, Microsoft Certified: Identity and Access Administrator, or equivalent practical experience.