Identity & Access Management (IAM) Subject Matter Expert

Gainwell Technologies LLC; Yorktown (VA); Remote; USD 95,000 - 136,000; Full time

Benefits offered by this job

Remote-based opportunity in the United

0-10% travel

Video interviews

401(k) employer match

Health benefits

Job summary

Gainwell Technologies is seeking an Identity & Access Management (IAM) Subject Matter Expert to evaluate, design, implement, and operate identity controls across on-prem and cloud environments. You will translate regulatory requirements into secure access policies and support audits with defensible evidence.

You will lead lifecycle governance, RBAC/ABAC design, federation, and PAM implementations while mentoring team members and shaping the long-term identity roadmap.

Qualifications

• 10+ years in IT / information security, with 7+ years hands-on IAM experience.
• Expert-level knowledge of IAM protocols (SAML, OAuth 2.0 / OIDC, SCIM, LDAP, Kerberos).
• Deep hands-on experience with AD and Microsoft Entra ID (Azure AD).
• Experience running IGA programs and/or PAM implementations.
• Experience enforcing least privilege across AWS and Azure.
• Strong automation capabilities (PowerShell or Python) and API integration.
• Experience supporting audits and mapping identity controls to frameworks.
• Project management experience leading IAM initiatives.
• Degree in a relevant field, or equivalent demonstrable experience.

Responsibilities

• Enforce IAM strategy, architecture, and roadmap aligned with business risks and regs.
• Oversee identity lifecycle, joiner-mover-leaver automation and access certification.
• Design RBAC/ABAC models and implement least-privilege policies and just-in-time elevation.
• Lead authentication, federation, SSO, SAML/OIDC/SCIM integrations, MFA policies.
• Guide PAM: vaulting, session management, credential rotation, privileged sessions.
• Administer AD, Entra ID, LDAP; ensure synchronization and trust hygiene.
• Enforce cloud IAM across AWS/Azure; manage service accounts and secret mgmt.
• Support audits; map controls to SOC 2, NIST, HIPAA, CMS; prepare evidence.
• Develop identity automation (PowerShell, Python, APIs) and SCIM provisioning.
• Deliver training, create runbooks, mentor teammates; evaluate IAM tooling.
• Plan IAM projects/migrations end-to-end from discovery to rollout.

Skills

IAM protocols (SAML,OIDC, OAuth, SCIM)

Active Directory / Azure AD

IGA / PAM programs

Least privilege enforcement

Automation: PowerShell / Python

Cloud IAM (AWS, Azure)

Audit support & mapping controls

IAM project management

SCIM provisioning

HRIS-to-directory integration

Education

Degree or equivalent experience

Tools

Okta

SailPoint

Saviynt

CyberArk

Job description

Be part of a team that unleashes the power of leading-edge technologies to help improve the health and well-being of those most vulnerable in our country and communities. Working at Gainwell carries its rewards. You’ll have an incredible opportunity to grow your career in a company that values work flexibility, learning, and career development. You’ll add to your technical credentials and certifications while enjoying a generous, flexible vacation policy and educational assistance. We also have comprehensive leadership and technical development academies to help build your skills and capabilities. Summary

Gainwell Technologies is hiring an Identity & Access Management (IAM) Subject Matter Expert to evaluate and advise on the design, implementation, and operation of our identity and access controls across on-premises and cloud environments.

In this role, you will act as a subject matter expert on secure implementation of identity: directories, authentication and federation, single sign-on, lifecycle management, privileged access, and identity governance. You will translate business and regulatory requirements into secure, workable access policies, evaluate access certification and least-privilege programs, and support audits with clean, defensible evidence. You will also advise engineers and stakeholders as a trusted escalation point for complex identity issues and shape the long-term identity roadmap.

This is a collaborative, team‑driven expert role that partners closely with a group of security experts who influence identity strategy and security across the entire organization. Success means achieving secure, automated, and well‑governed identity.

Your role in our mission

1. Enforce the IAM strategy, architecture, and roadmap, aligning access controls with business needs, risk appetite, and regulatory obligations.
2. Identity lifecycle and governance: Review and advise drive joiner-mover-leaver (JML) automation, account provisioning and de-provisioning, access certification campaigns, and segregation-of-duties (SoD) reviews.
3. Access control design: Review and advise design and review role-based (RBAC) and attribute-based (ABAC) access models, least-privilege policies, and just-in-time (JIT) elevation across applications and infrastructure.
4. Authentication and federation: Review and advise architecture and operational SSO, SAML/OIDC/SCIM integrations, federation trusts, MFA policies, and conditional access rules.
5. Privileged access management (PAM): Review and advise on implementation and run vaulting, session management, credential rotation, and privileged session monitoring.
6. Directory services: Review and advise on administer and secure Active Directory, Microsoft Entra ID (Azure AD), and LDAP directories, including synchronization and trust hygiene.
7. Cloud IAM: Review and advise with enforcement of least privilege on AWS, Azure, roles, policies, service accounts, workload identity, and secret management.
8. Compliance and audit: Review and advise on mapped identity controls to SOC 2, NIST, HIPPA, CMS and other frameworks; Review and advise with preparation of evidence; respond to audit requests and remediate findings.
9. Automation and integration: Review and advise on build and maintain identity automation (PowerShell, Python, APIs), SCIM-based provisioning, and HR-as-source-of-truth integrations.
10. Operations and enablement: act as subject matter expect for document standards and runbooks, deliver training, and mentor team members.
11. Vendor and tooling evaluation: Review and advise on assessing and manage identity platforms (IGA, PAM, IdP, IDB and CIAM).
12. Project delivery: plan, scope, and lead IAM projects and migrations end-to-end, timelines, dependencies, stakeholder coordination, risk tracking, and rollout, from discovery through hypercare.

What we're looking for

• 10 + years in IT / information security, with 7 + years of hands-on IAM experience
• Expert-level working knowledge of IAM protocols (SAML, OAuth 2.0 / OIDC, SCIM, LDAP, Kerberos)
• Deep hands-on experience with Active Directory and Microsoft Entra ID (Azure AD)
• Proven experience running IGA programs (access certifications, SoD) and/or PAM implementations
• Experience enforcing least privilege across cloud environments (AWS, Azure)
• Strong automation capability (PowerShell or Python) and API integration experience
• Experience supporting audits and mapping identity controls to frameworks such as SOC 2, SOC 2, NIST, HIPPA, CMS
• Project management experience: leading IAM initiatives (migrations, IGA/PAM rollouts, SSO deployments) from planning through delivery, with clear timelines, dependencies, and stakeholder communication
• Degree in a relevant field, or equivalent demonstrable experience

Preferred & certifications

• CISSP, CISM, or equivalent security certification
• Microsoft Certified: Identity and Access Administrator Associate (SC-300)
• Vendor certifications: Okta, SailPoint, Saviynt, CyberArk, or equivalent
• Cloud certifications (AWS, Azure) and zero trust architecture exposure
• Experience with HRIS-to-directory integration and identity automation at scale

What you should expect in this role

• Remote-based opportunity within the United States
• Opportunities to travel through your work (0-10%)
• Video cameras must be used during all interviews, as well as during the initial week of orientation
• The deadline to submit applications for this posting is 11/30/2026

The pay range for this position is $95,100.00 - $135,800.00 per year, however, the base pay offered may vary depending on geographic region, internal equity, job-related knowledge, skills, and experience among other factors. Put your passion to work at Gainwell. You’ll have the opportunity to grow your career in a company that values work flexibility, learning, and career development. All salaried, full-time candidates are eligible for our generous, flexible vacation policy, a 401(k) employer match, comprehensive health benefits , and educational assistance. We also have a variety of leadership and technical development academies to help build your skills and capabilities.

We believe nothing is impossible when you bring together people who care deeply about making healthcare work better for everyone. Build your career with Gainwell, an industry leader. You’ll be joining a company where collaboration, innovation, and inclusion fuel our growth. Learn more about Gainwell at our company website and visit our Careers site for all available job role openings.

Gainwell Technologies is an Equal Opportunity Employer, where all qualified applicants will receive consideration for employment without regard to race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical condition), age, sexual orientation, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics. Gainwell Technologies defines “wages” and “wage rates” to include “all forms of pay, including, but not limited to, salary, overtime pay, bonuses, stock, stock options, profit sharing and bonus plans, life insurance, vacation and holiday pay, cleaning or gasoline allowances, hotel accommodations, reimbursement for travel expenses, and benefits.