IAM / Automation Lead

Covetrus, Inc.; Northern (KY); Hybrid; USD 140,000 - 190,000; Full time

Benefits offered by this job

401k savings & company match

Paid time off

Paid holidays

Maternity leave

Parental leave

Military leave

Other leaves of absence

Health, dental, and vision benefits

Health savings accounts

Flexible spending accounts

Life & disability benefits

Identity theft protection

Pet insurance

Short-term incentive plan eligibility

Job summary

Covetrus, Inc. seeks an IAM leader to serve as North America COE lead, guiding SSO, MFA, PAM, IGA, and directory services across mergers and operations.

You will drive automation and self-service, partnering with HRIS, IT, Cyber, and Procurement, and report program health with KPIs while aligning with security frameworks. A strong enterprise IAM track record and mentoring ability are essential.

Qualifications

• 8+ years progressive experience in information security or IT, with 4+ years IAM focus.
• Senior/lead technical contributor on IAM in a mid-to-large enterprise (5,000+ employees).
• Hands-on engineering for enterprise IAM automation and provisioning pipelines.
• Experience automating JML with HRIS platforms to drive straight-through processing.
• Experience automating access certification campaigns and audits.
• Experience managing PAM programs with vault platforms in production.
• Certifications preferred (CISSP, CIAM, SC-300, Okta Certified Professional).

Responsibilities

• Lead IAM program design, implementation, and operations (SSO, MFA, PAM, IGA, directory services).
• Drive automation and self-service to reduce manual provisioning and improve user experience.
• Partner with IT, HR, Legal, Compliance, Cyber, and Procurement to align IAM roadmap and governance.
• Oversee audits (SOX, SOC 2, ISO 27001, HIPAA) with evidence collection and remediation tracking.
• Mentor IAM engineers and analysts; build dashboards and KPIs for leadership visibility.

Skills

IAM leadership

M&A integration leadership

SSO

MFA

PAM

IGA

Zero Trust

Automation engineering

SCIM/LDAP/API connectors

KPI reporting

Tools

CyberArk

BeyondTrust

Delinea

HRIS integrations (Workday/SAP SuccessFactors)

Job description

* Serve as the North American Center of Excellence (COE) lead for IAM, partnering with global COE counterparts to align standards, tooling, and best practices - ensuring IAM responsibilities and services are delivered consistently on a global basis* Serve as the technical lead for IAM integration on current and future mergers, acquisitions, and divestitures (M&A)* Lead the design, implementation, and operations of IAM programs including SSO, MFA, PAM, IGA, and directory services* Deliver measurable cost savings and operational efficiencies by leading product evaluations, tools consolidations, and IAM initiatives back by data-driven financial business cases* Enforce compliance with IAM policies and standards; Create procedures aligned to NIST, CIS, ISO 27001, SOX, and other applicable frameworks* Own user lifecycle management: joiner/mover/leaver (JML) execution, access provisioning, role engineering, and automated de-provisioning* Drive automation and self-service capabilities across the IAM function - including automated access requests, approvals, and provisioning - to reduce manual operations and improve the end-user service experience* Partner with End User Services and the Service Desk to identify and automate away manual, ticket-based access requests, replacing them with self-service and automated workflows* Deliver automated entitlement and permission reviews across SaaS, cloud, and on-prem applications* Mature Privileged Access Management (PAM) adoption, including vault adoption, session monitoring, and just-in-time (JIT) access* Partner with Cyber and Network Operations on global user controls, including Zero Trust and SSO group management - leading identity-centric network access controls and conditional access policy development* Build and maintain integrations between IAM platforms, HR systems (HCM), ticketing systems, and downstream applications via SCIM, LDAP, and API connectors* Define KPIs and metrics for access hygiene, orphaned accounts, and privilege sprawl; report SLA performance and program health to leadership quarterly* Partner across teams to advance the IAM roadmap, and support IAM vendor relationships, licensing, and contract renewals in collaboration with Cyber and Procurement* Serve as a technical mentor to IAM engineers and analysts, sharing best practices in design, implementation, and troubleshooting* Support audits (SOX, SOC 2, ISO 27001) with evidence of quarterly access reviews, control narratives, and remediation tracking* Drive IAM roadmap planning with a 12-18 month horizon, balancing security uplift with employee experience* 8+ years of progressive experience in information security or information technology, including 4+ years focused specifically on Identity and Access Management (IAM), with a demonstrated track record of applying automation and engineering discipline to reduce risk and manual effort* 3+ years serving as a senior or lead technical contributor on an IAM function or program within a mid-to-large enterprise environment (5,000+ employees), with direct accountability for security outcomes and operational metrics* Hands-on engineering experience designing, building, and operating enterprise IAM automation - including workflow engines, API/SCIM-based provisioning pipelines, and self-service access solutions that eliminate manual, ticket-based processes* Experience integrating joiner/mover/leaver (JML) automation with an HRIS platform (e.g., Workday, SAP SuccessFactors, or similar) to drive straight-through processing and eliminate manual provisioning touchpoints* Experience automating access certification/recertification campaigns at enterprise scale, reducing audit preparation time and manual reviewer effort* Experience supporting compliance and security audits (SOX, SOC 2, ISO 27001, HIPAA, or equivalent), with a focus on building repeatable, automated evidence-collection and control-monitoring processes* Experience managing PAM programs and vault platforms (e.g., CyberArk, BeyondTrust, Delinea) in production, including automating credential rotation, session monitoring, and just-in-time access to shrink the enterprise attack surface* Demonstrated success building data-driven business cases that translate automation and tooling consolidation into measurable cost savings and licensing efficiencies* Relevant industry certifications preferred (e.g., CISSP, CIAM, SC-300, Okta Certified Professional, or equivalent)* Strong engineering mindset: able to design, script, and deploy automated identity workflows (SCIM, LDAP, REST/API connectors) rather than relying on manual or ticket-driven processes* Proven ability to identify high-friction, manual IAM operations and re-architect them into scalable, self-service, automated solutions* Skilled in building automated provisioning, de-provisioning, and entitlement review pipelines across SaaS, cloud, and on-prem systems* Comfortable working across scripting/automation tooling (e.g., PowerShell, Python, workflow orchestration platforms) to extend platform capabilities beyond out-of-the-box functionality* Deep working knowledge of authentication and federation protocols (SAML 2.0, OAuth 2.0, OIDC, Kerberos, LDAP/LDAPS) and how they underpin a secure identity fabric* Strong grasp of Zero Trust architecture, conditional access, and least-privilege enforcement as engineering requirements, not just policy statements* Ability to harden IAM/PAM environments against credential theft, privilege escalation, and lateral movement, and to translate threat intelligence into control improvements* Skilled in defining and tracking security KPIs (orphaned accounts, privilege sprawl, stale entitlements, MFA/phishing-resistant authentication coverage) to continuously mature the identity security posture* Track record of measurably reducing manual operations, ticket volume, and mean-time-to-provision through automation and process redesign* Strong bias toward eliminating toil: consistently looks for ways to remove human touchpoints from repeatable IAM processes without compromising control* Ability to design for scale and resilience, ensuring automated processes hold up across M&A integrations, org changes, and growth* Skilled in building dashboards/metrics that give leadership real-time visibility into program health and operational throughput* Ability to build and present data-driven financial business cases for tooling consolidation, license optimization, and platform rationalization* Skilled in quantifying the ROI of automation initiatives (labor hours saved, ticket deflection, reduced audit remediation costs)* Strong vendor and contract management acumen, able to negotiate and manage IAM licensing to avoid overspend and redundant tooling* Ability to serve as a technical mentor, instilling automation-first and security-first engineering practices in junior engineers and analysts* Strong cross-functional collaboration with IT, HR, Legal, Compliance, Cyber, and Procurement to align automation initiatives with business and audit requirements* Effective communicator, able to translate technical automation and security work into business impact and cost-savings narratives for executive leadership* *401k savings & company match** *Paid time off** *Paid holidays** *Maternity leave** *Parental leave** *Military leave** *Other leaves of absence** *Health, dental, and vision benefits** *Health savings accounts** *Flexible spending accounts** *Life & disability benefits** *Identity theft protection** *Pet insurance** *Certain positions may include eligibility for a short-term incentive plan*