IAM Engineer III, Identity & Access Management

Chewy, Inc.; Bellevue (WA); On-site; USD 119,000 - 190,000; Full time

Benefits offered by this job

401k

Annual equity grant

Annual bonus

Unlimited PTO (subject to manager)

Six paid holidays per year

Comprehensive medical/dental/vision

Life and disability insurance

Pet adoption reimbursement

Flexible spending accounts

Employee assistance program

Job summary

Chewy is seeking an IAM Engineer III to set technical direction for identity platforms, primarily SailPoint Identity Security Cloud alongside Okta, and own large projects that automate manual work. You will mentor junior engineers, lead design reviews, and influence governance for human and non-human identities, including AI agents.

You will own projects end-to-end, drive automation to reduce repetitive work, and partner with our Okta experts on access patterns while ensuring strong controls and

Responsibilities

• Own IAM projects end to end: define the problem and starting numbers, design the fix, lead the build, roll it out, and prove the result.
• Hunt down repeat work and turn recurring tickets, incidents, and review findings into automation or self-service.
• Set direction and design solutions in SailPoint ISC: lifecycle, provisioning, correlation, connectors, transforms, workflows, and roles.
• Partner with Okta experts on application access, lifecycle, and provisioning patterns.
• Own the technical debt list for your area and clear the highest-value items first.
• Lead root-cause analysis for failures and turn each into a lasting fix.
• Mentor IAM Engineer I and II staff through design reviews and pairing.
• Govern non-human identities and take part in on-call rotation for critical identity services.

Job description

Our Opportunity

Chewy's IAM team keeps the right people, services, and AI agents connected to the right access, from someone's first day to their last. As an

Job Description

Our Opportunity

Chewy's IAM team keeps the right people, services, and AI agents connected to the right access, from someone's first day to their last. As an IAM Engineer III, a senior individual-contributor role, you'll set technical direction for our identity platforms, primarily SailPoint Identity Security Cloud alongside Okta, and own the big projects that make whole categories of manual work disappear. This isn't a ticket-queue role. Your success is measured by the work you eliminate: request types automated away, manual steps removed, and cycle times cut, all while keeping strong controls and clean audit evidence. You'll mentor IAM Engineer I and II staff, lead design reviews, and help shape how Chewy governs non-human identities, including AI agents.

What You'll Own In Your First Year

• Modernize the joiner experience. Redesign how new hires move from offer to day one: accounts ready ahead of time, the right access exactly on the start date, and nothing early.
• Automate birthright access at scale. Turn manual license and access requests into rule-based roles that grant and remove access on their own as people join, move, and leave.
• Strengthen the leaver and contractor lifecycle. Make sure access ends exactly when employment or a contract ends, with proof.
• Onboard and run SailPoint Machine Identity Security (MIS) and Data Access Security (DAS), extending governance to service accounts, machine identities, and sensitive data access.
• Consolidate access onto modern, requestable patterns, working with our identity provider experts to move app access off legacy directory groups.
• Build safe automation, with AI where it helps, that removes manual work, keeps human approval where it matters, and leaves clear evidence for audit.

What You'll Do

• Own IAM projects end to end: define the problem and the starting numbers, design the fix, lead the build, roll it out, and prove the result.
• Hunt down repeat work. Turn recurring tickets, incidents, and review findings into automation or self-service that removes them for good.
• Set direction and design solutions in SailPoint ISC: lifecycle, provisioning, correlation, connectors, transforms, workflows, and roles, with safe change practices (testing, staged rollout, rollback).
• Partner with our Okta experts on application access, lifecycle, and provisioning patterns.
• Own the technical debt list for your area and clear the highest-value items first.
• Lead root-cause analysis for serious failures and turn each into a lasting fix.
• Mentor IAM Engineer I and II staff through design reviews and pairing.
• Govern non-human identities (service accounts, workloads, AI agents) and take part in the on-call rotation for critical identity services.

Bonus (Nice to Have)

• SailPoint ISC certification (e.g. ISC Engineer) and/or Okta Certified Professional or Administrator
• Experience building AI-assisted automation or agent-based workflows, with human approval steps and audit-ready evidence
• Experience governing non-human identities: service accounts, workload identities, or AI agent credentials
• Experience with HR-driven lifecycle (Workday as the source of truth) and birthright role design at scale
• Experience integrating identity with service management (ServiceNow catalog and request flows)
• Background in audit and control evidence: certifications, separation of duties, least privilege

The base salary range for this role is $118,500 - $189,500.00.

• The specific salary offered to a candidate may be influenced by a variety of factors including but not limited to the candidate’s relevant experience, education, and work location. In addition, this position is eligible for 401k and a new hire and annual equity grant. C08+ positions may also be eligible for annual bonus.

We offer different types of insurance and benefits, such as medical/Rx, vision, dental, life, disability, hospital indemnity, critical illness, accident. We offer parental leave, family services benefits, backup dependent care, flexible spending accounts, telemedicine, pet adoption reimbursement, employee assistance program, and many discounts including 10% off pet insurance and 20% off at Chewy.com. Exempt salary team members have unlimited PTO, subject to manager approval. Team members will receive six paid holidays per year. Team members may be eligible for paid sick and family leave in compliance with applicable state and local regulations.

Chewy is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, ancestry, national origin, gender, citizenship, marital status, religion, age, disability, gender identity, results of genetic testing, veteran status, as well as any other legally-protected characteristic. If you have a disability under the Americans with Disabilities Act or similar law, and you need an accommodation during the application process or to perform these job requirements, or if you need a religious accommodation, please contact [e-mail].

To access Chewy's California CPRA Job Applicant Privacy Policy, please click here.