IAM Cloud Platform Engineer – Federation & Access Automation

Florida Blue Group; United States; Hybrid; USD 109,000 - 178,000; Full time

Benefits offered by this job

Medical, dental, vision insurance

Retirement Savings Plan with employer

Paid time off & holidays

Well-being program

Job summary

Florida Blue is migrating to AWS across commercial and GovCloud partitions. The IAM Engineer owns how identity works in that environment: federation from the enterprise identity provider, access lifecycle into cloud accounts, and the authorization model that product teams build against.

This role designs entitlement patterns, automates joiner/mover/leaver, and builds workload identities with OIDC for pipelines, SSO onboarding, and audit-ready recertification.

Qualifications

• 6+ years related work experience in IAM, security, or platform engineering, with 3+ years focused on cloud identity.
• Hands-on experience with SSO and federation platforms.
• Experience integrating enterprise identity providers (Okta, Entra ID, Ping) with cloud.
• Working knowledge of SAML, OIDC, and SCIM.
• Certified Information Systems Security Professional (CISSP) within 180 days of hire.

Responsibilities

• Design and operate federation and the entitlement model across accounts.
• Automate access lifecycle: joiner, mover, leaver.
• Build workload identity patterns; eliminate long-lived keys and standing access.
• Build access recertification and produce audit evidence.
• Onboard applications to SSO and review access designs with application teams.
• Integrate cloud entitlements with the enterprise identity governance platform.
• Design workload and machine identity patterns, including roles for services and OIDC for pipelines.

Skills

AWS IAM

Azure IAM

SSO

Federation

OIDC

SAML

Education

Bachelor's degree

Tools

Terraform

Job description

Florida Blue is migrating to AWS across commercial and GovCloud partitions. The IAM Engineer owns how identity works in that environment: federation from the enterprise identity provider, access lifecycle into cloud accounts, and the authorization model that product teams build against.

This role designs entitlement patterns, automates joiner/mover/leaver, and builds workload identities with OIDC for pipelines, SSO onboarding, and audit-ready recertification.