IAM Engineer: PKI & Directory Security Specialist

New York City Office of Technology & Innovation; New York (NY); On-site; USD 90,000 - 130,000; Full time

Job summary

New York City Office of Technology & Innovation is seeking an IAM Engineer to design, administer, and improve the agency's identity and access management environment. The role covers certificate lifecycle, PKI operations, and enterprise IAM across Microsoft Entra ID and Active Directory.

It requires collaboration with security and infrastructure teams to ensure secure, reliable IAM services. Responsibilities include managing AD CS and CAs, supporting HSM operations, and enforcing access

Qualifications

• Bachelor's degree required or equivalent
• 4+ years of full-time experience in related projects/policies

Responsibilities

• Support design, administration, maintenance and improvement of the IAM environment.
• Manage certificate lifecycle and PKI operations (AD CS and third‑party CAs).
• Support HSM operations and key ceremonies under senior staff guidance.
• Maintain CLM tooling for certificate tracking, automation and reporting.
• Troubleshoot certificate‑related production issues and elevate complex problems.
• Apply PKI standards and compliance guidelines (NIST, CIS).
• Contribute to governance, security initiatives, and special projects as assigned.
• Coordinate with infrastructure, security, and application teams to keep IAM services reliable and secure.

Skills

PKI administration

Microsoft Entra ID

Active Directory

Access management

Identity governance

Conditional access

MFA

PowerShell scripting

Python

IAM troubleshooting

Education

Bachelor's degree

Job description

New York City Office of Technology & Innovation is seeking an IAM Engineer to design, administer, and improve the agency's identity and access management environment. The role covers certificate lifecycle, PKI operations, and enterprise IAM across Microsoft Entra ID and Active Directory.

It requires collaboration with security and infrastructure teams to ensure secure, reliable IAM services. Responsibilities include managing AD CS and CAs, supporting HSM operations, and enforcing access