Identity Access Management (IAM) Engineer – Identity Governance and Administration

600 UMG Recordings Inc; United States; On-site; USD 90,000 - 130,000; Full time

Benefits offered by this job

Comprehensive medical, dental, vision, and mental health coverage

401(k) plan with 100% immediate vesting

Flexible paid time off

Student loan repayment assistance

Generous paid parental leave

Job summary

600 UMG Recordings Inc is seeking an Identity & Access Management Engineer specializing in Identity Governance & Administration (IGA). In this role, you will design, implement, and manage enterprise IGA solutions across a global environment, ensuring the governance of digital identities and access entitlements.

The ideal candidate should have over 5 years of experience in IAM roles and a deep understanding of identity lifecycle management. The position involves close collaboration with various teams and implementing cutting-edge IGA capabilities.

Qualifications

• 5+ years of hands-on experience in Identity & Access Management or Security Engineering roles with a strong focus on Identity Governance & Administration.
• Demonstrated experience implementing and operating enterprise IGA platforms (e.g., Saviynt, SailPoint, or equivalent).
• Strong understanding of identity lifecycle management, access provisioning, role-based access control (RBAC), and entitlement governance.
• Hands-on experience designing and supporting access certification campaigns and remediation processes.
• Experience integrating IGA solutions with HR systems, Active Directory / Entra ID, and enterprise applications.
• Proficiency in scripting and automation using tools such as PowerShell or Python.
• Experience working in hybrid and cloud environments (Azure and/or AWS) with IAM integrations.
• Ability to independently own complex technical deliverables while collaborating effectively within a global organization.
• Strong troubleshooting, documentation, and communication skills.

Responsibilities

• Design, engineer, deploy, and operate Identity Governance & Administration (IGA) solutions across the enterprise.
• Implement and manage identity lifecycle processes including joiner, mover, and leaver (JML) workflows for employees and non-employee identities.
• Engineer and maintain access request, approval, and provisioning workflows integrated with HR systems, directories, and enterprise applications.
• Design and operate access governance controls including role models, entitlement catalogs, access certifications, and periodic access reviews.
• Partner with application owners and platform teams to onboard applications into IGA and remediate access governance gaps.
• Develop and maintain automation and integrations for IGA workflows using scripting, APIs, and infrastructure-as-code approaches such as PowerShell and Python.
• Support segregation of duties (SoD) controls, access policy enforcement, and audit readiness activities.
• Troubleshoot and resolve complex identity lifecycle, provisioning, and access-related issues across integrated systems.
• Collaborate with Security, HR, Compliance, and Infrastructure teams to align identity governance controls with security policies and regulatory requirements.
• Maintain technical documentation, configuration standards, and operational runbooks to support scalable and repeatable IGA operations.
• Continuously identify opportunities to improve access governance maturity, reduce manual effort, and enhance user experience through automation and platform enhancements.

Job description

Job Summary

We are currently seeking an Identity & Access Management Engineer with specialization in Identity Governance & Administration (IGA) to join UMG’s global Tech Security & Identity organization. The role requires designing, implementing, and operating enterprise IGA capabilities across a complex, global environment, governing digital identities and access entitlements for employees, contractors, and non‑employees. The engineer will partner closely with security, HR, infrastructure, and application teams to ensure access is provisioned appropriately, reviewed regularly, and removed in a timely manner.

Job Functions

• Design, engineer, deploy, and operate Identity Governance & Administration (IGA) solutions across the enterprise.
• Implement and manage identity lifecycle processes including joiner, mover, and leaver (JML) workflows for employees and non‑employee identities.
• Engineer and maintain access request, approval, and provisioning workflows integrated with HR systems, directories, and enterprise applications.
• Design and operate access governance controls including role models, entitlement catalogs, access certifications, and periodic access reviews.
• Partner with application owners and platform teams to onboard applications into IGA and remediate access governance gaps.
• Develop and maintain automation and integrations for IGA workflows using scripting, APIs, and infrastructure‑as‑code approaches such as PowerShell and Python.
• Support segregation of duties (SoD) controls, access policy enforcement, and audit readiness activities.
• Troubleshoot and resolve complex identity lifecycle, provisioning, and access‑related issues across integrated systems.
• Collaborate with Security, HR, Compliance, and Infrastructure teams to align identity governance controls with security policies and regulatory requirements.
• Maintain technical documentation, configuration standards, and operational runbooks to support scalable and repeatable IGA operations.
• Continuously identify opportunities to improve access governance maturity, reduce manual effort, and enhance user experience through automation and platform enhancements.

Job Requirements

Essential Qualifications

• 5+ years of hands‑on experience in Identity & Access Management or Security Engineering roles with a strong focus on Identity Governance & Administration.
• Demonstrated experience implementing and operating enterprise IGA platforms (e.g., Saviynt, SailPoint, or equivalent).
• Strong understanding of identity lifecycle management, access provisioning, role‑based access control (RBAC), and entitlement governance.
• Hands‑on experience designing and supporting access certification campaigns and remediation processes.
• Experience integrating IGA solutions with HR systems, Active Directory / Entra ID, and enterprise applications.
• Proficiency in scripting and automation using tools such as PowerShell or Python.
• Experience working in hybrid and cloud environments (Azure and/or AWS) with IAM integrations.
• Ability to independently own complex technical deliverables while collaborating effectively within a global organization.
• Strong troubleshooting, documentation, and communication skills.

Desirable Qualifications

• Bachelor’s degree in Computer Science, Information Security, Engineering, or a related technical discipline.
• Experience with advanced IGA capabilities such as role mining, access analytics, or policy‑based provisioning.
• Familiarity with compliance and audit frameworks such as SOX, ISO 27001, NIST, or similar.
• Professional certifications such as Saviynt Certified Professional, SailPoint Certified IdentityIQ Engineer, Security+, or CISSP.
• Experience operating IAM or identity governance platforms within a large, global, or highly regulated enterprise environment.

Benefits

• Comprehensive medical, dental, vision, and out‑patient mental health coverage.
• Fertility coverage for eligible medical plan participants.
• Well‑being reimbursements for fitness classes, spa treatments, meal services, travel, and more (up to $720 per year).
• Student loan repayment assistance and tuition reimbursement.
• 401(k) plan with 100% immediate vesting on the first 5% of contributions, plus additional company contribution.
• Flexible paid time off (PTO) for exempt employees and 3‑week PTO for non‑exempt employees.
• 2‑week paid winter break, 10 company holidays including Juneteenth and Well‑Being Day.
• Summer Fridays between Memorial Day and Labor Day.
• Generous paid parental leave for all types of parents.

Universal Music Group is an Equal Opportunity Employer. We are an E‑Verify employer in Alabama, Arizona, Georgia, Mississippi, North Carolina, South Carolina, Tennessee, and Utah. Universal Music Group is not enrolled in E‑Verify in California and New York, and cannot support employment of candidates whose employer must enroll in E‑Verify, for example candidates on STEM‑OPT.