Identity & Access Security Engineer — IAM, PAM & Governance

Brown Advisory Incorporated; Baltimore (MD); On-site; USD 110,000 - 135,000; Full time

Benefits offered by this job

Medical

Dental

Vision

401(k)

Job summary

Brown Advisory Incorporated is seeking an Identity and Access Security Engineer to lead and mature identity controls across Okta, Entra ID, AD, and PAM. This hands‑on role blends security engineering with governance to reduce identity‑related risk while enabling secure SaaS, cloud, and on‑premises adoption.

You will own day‑to‑day governance, design privileged‑access controls with CyberArk, and drive remediation across Tier Zero identities.

Qualifications

• Bachelor's degree or equivalent experience in a relevant field.
• 4–8 years in information security or IAM roles.
• Hands-on with Entra ID and Active Directory; CyberArk experience essential.

Responsibilities

• Lead identity‑security governance across IAM, PAM, MFA, and access reviews.
• Design and operate CyberArk privileged‑access controls and onboarding.
• Manage lifecycle of privileged identities and service accounts.
• Oversee identity lifecycle automation and integration with SaaS apps.
• Lead application integration with Okta and Entra ID for SSO, provisioning, and deprovisioning.
• Provide guidance on secure identity patterns to teams and leadership.

Skills

Identity security

IAM governance

Threat exposure

Privilege management

Automation via APIs

Education

Bachelor's degree in cyber security / CS / IS / engineering

Tools

Okta

Microsoft Entra ID

Active Directory

CyberArk

BloodHound Enterprise

PowerShell

Microsoft Graph

REST APIs

SIEM

Job description

Brown Advisory Incorporated is seeking an Identity and Access Security Engineer to lead and mature identity controls across Okta, Entra ID, AD, and PAM. This hands‑on role blends security engineering with governance to reduce identity‑related risk while enabling secure SaaS, cloud, and on‑premises adoption.

You will own day‑to‑day governance, design privileged‑access controls with CyberArk, and drive remediation across Tier Zero identities.