Identity Operations Engineer

UMG Recordings; Nashville (TN); In loco; USD 110.000 - 160.000; Tempo pieno

Descrizione del lavoro

UMG is seeking an Identity Operations Engineer to run and improve hybrid identity services across Workday-driven processes, Saviynt/IGA, AD, Entra ID, and MFA. You will handle joiners, movers, leavers, privileged accounts, and non-human identities, delivering incident, request, change, and audit support.

You will partner with Engineering, Cloud, ITSM, security, and regional teams to maintain reliable integrations, resolve provisioning issues, and ensure governance and audit evidence throughout

Competenze

• Experience operating identity lifecycle integrations across joiners, movers, leavers, contractors.
• Familiar with Workday-driven lifecycle processes and Saviynt/IGA workflows.
• Experience supporting on-premises and cloud identity services (AD, Entra ID, 365).

Mansioni

• Apply least-privilege and identity-governance practices to protect resources.
• Troubleshoot identities, access, authentication, and entitlements.
• Handle escalations from AD Services and TechOps IAM queues.
• Provide ITIL-based operational support across identity services.
• Operate identity lifecycle integrations for joiners/movers/leavers.
• Support Workday-driven lifecycle processes and Saviynt workflows.
• Maintain auditable evidence for access approvals and reviews.
• Participate in security incident response teams as needed.

Conoscenze

Identity governance

IAM operations

Active Directory

Microsoft Entra ID

MFA

Privileged access

Application access

Strumenti

Saviynt

CyberArk

Duo

YubiKey

HashiCorp Vault

1Password

PingOne/Aura

Splunk

Descrizione del lavoro

We are UMG, the Universal Music Group. We are the world's leading music company. In everything we do, we are committed to artistry, innovation and entrepreneurship. We own and operate a broad array of businesses engaged in recorded music, music publishing, merchandising, and audiovisual content in more than 60 countries. We identify and develop recording artists and songwriters, and we produce, distribute and promote the most critically acclaimed and commercially successful music to delight and entertain fans around the world.

Job Summary

As a key member of the UMG Operations Center, the Identity Operations Engineer operates and continuously improves UMG's hybrid identity, access, authentication, privileged-access, and identity-governance services. The role provides specialist operational support across Workday-driven identity lifecycle processes, Saviynt/IGA, Active Directory, Microsoft Entra ID, Microsoft 365, MFA, PAM, enterprise application integrations, and connected services.

The position will be a team player working to maintain reliable identity integrations and resolve operational issues involving joiners, movers, leavers, contractors, rejoiners, application access, entitlements, authentication, privileged accounts, and non-human identities. The role includes incident, request, change, problem, access-review, audit-evidence, monitoring, and automation activities. The role partners closely with Engineering, Architecture, Cloud, Observability, ITSM, security, regional IT teams, and external providers. Effective communication skills are a must, all while being sensitive to a wide diversity of cultural and technical backgrounds in a global business environment.

Job Functions

• Apply least-privilege, segregation-of-duties, secure administration, and identity-governance best practices to protect UMG information resources from unauthorized use, inappropriate access, disclosure, damage, or loss.
• Troubleshoot and resolves issues related to identities, systems, access, accounts, authentication, authorization, entitlements, and permissions.
• Investigate and resolve specialist escalations from AD Services and TechOps IAM queues, including application-role access, SecAdmin access, reference-user comparisons, disabled application accounts, access removals, and entitlement issues.
• Provide ITIL-based operational support across identity services, including incident, request, change, problem, and major-incident participation. Maintain clear ServiceNow assignment, evidence, troubleshooting notes, resolution details, and closure criteria.
• Operate and troubleshoot identity lifecycle integrations, including joiner, mover, leaver, contractor, rehire/rejoiner, and exception scenarios. Investigate failed provisioning tasks, reconciliation issues, orphaned accounts, and mismatches between authoritative HR data, IGA records, directories, and target applications.
• Support Workday-driven lifecycle processes and Saviynt/IGA workflows, including access requests, approvals, entitlement ownership, access reviews, remediation, audit evidence, and provisioning/reconciliation failures.
• Operate and support on-premises and cloud identity services and their configuration, including Active Directory domain services, Microsoft Entra ID, Microsoft 365, Duo, YubiKey/FIDO/PIV authentication, CyberArk/PAM, Saviynt/IGA, Splunk, Active Roles where applicable, PingOne/Aura where applicable, 1Password, HashiCorp Vault, and connected enterprise applications.
• Troubleshoot Microsoft Entra enterprise applications and federation integrations, including SAML, OIDC/OAuth, claims, redirect URIs, app registrations, group assignments, Conditional Access, Microsoft Graph, certificates, and token/authentication failures.
• Support privileged and non-human identities, including elevated accounts, service accounts, application accounts, RPA accounts, resource/test accounts, B2B/guest identities, and accounts requiring vault onboarding, password rotation, or ownership validation.
• Support MFA and authentication operations, including Duo, YubiKey, FIDO/PIV, recovery/reset workflows, OAuth-token issues, and authentication failures across workforce and application services.
• Complete the key metric reporting and analysis for the Identity Management environment as required.
• Work to ensure audit tasks related to Identity Management are completed on time, with participation of appropriate parties. Maintain auditable evidence for access approvals, reviews, privileged access, lifecycle actions, exceptions, and remediation.
• Participate in security incident response teams as needed, including identity compromise, suspicious authentication, privileged-access, credential, and account-containment activities.
• Utilize industry best practices for appropriate standards, processes, procedures, tools, and documentation.
• Ensure the maintenance, patching, operating, and monitoring of IAM systems is in place and completed on schedule. Use Splunk and observability service dashboards to