Identity Security Engineer

American Tower; Cary (NC); On-site; USD 130,000 - 170,000; Full time

Job summary

American Tower is seeking an Identity Security Engineer to strengthen identity security across cloud, on‑prem, and hybrid environments. You will implement Zero Trust concepts, RBAC, and Just-In-Time access while reducing privileged access risks.

The role is onsite in Cary, NC with a hybrid schedule requiring in-office presence Tuesday through Thursday. You will collaborate with Security Operations, Infrastructure, and application teams to secure enterprise identities.

Qualifications

• Bachelor’s degree in Cybersecurity, IT, Computer Science, Engineering, or related field or equivalent.
• 3+ years designing, implementing, and supporting IAM, PAM in large enterprises.
• 2+ years administering CyberArk Privilege Cloud, CyberArk PAM, Delinea, BeyondTrust.
• Experience with ZSP, JIT, least privilege, RBAC, break-glass access.
• Strong knowledge of Microsoft Entra ID, Conditional Access, PIM, MFA, Identity Protection, directory services, modern authentication.
• Understanding SSO, federation, authentication, and authorization technologies (SAML, OAuth 2.0, OIDC, LDAP, AD).
• Automation using PowerShell, Python, REST APIs.
• Ability to assess identity security risks and communicate with stakeholders.
• Approximately 5% travel possible.

Responsibilities

• Design and support IAM and PAM across cloud, on-prem, and hybrid environments.
• Engineer privileged access capabilities including vaulting, rotation, session management, onboarding, break‑glass access, lifecycle management.
• Advance ZSP, JIT access, least privilege, privileged access reduction, and RBAC initiatives.
• Implement and support Microsoft Entra ID capabilities including CA, PIM, MFA, Identity Protection, passwordless authentication, and access controls.
• Design and support SSO, federation, and modern authentication integrations using SAML, OAuth 2.0, OIDC, LDAP.
• Secure privileged and non-human identities and onboard systems to PAM platforms.
• Collaborate with infrastructure, cloud, application, and platform teams to onboard assets to PAM and identity security platforms.
• Develop and maintain privileged access standards and runbooks.

Skills

IAM

PAM

CyberArk

Entra ID

MFA

SSO/OIDC

PowerShell

Python

RBAC

Zero Trust

Education

Bachelor’s degree in Cybersecurity/IT/CS/Engineering

Tools

Delinea

BeyondTrust

Job description

The Team

We are seeking an Identity Security Engineer to join American Tower’s Information Security organization. This role strengthens identity security, reduces privileged access risk, and enables secure access to enterprise systems, data, and cloud resources. As an Identity Security Engineer, you will engineer and support identity and privileged access solutions across cloud, on-premises, and hybrid environments. You will help advance Zero Trust through Zero Standing Privilege (ZSP), Just-In-Time (JIT) access, least privilege, Role Based Access Controls (RBAC), Conditional Access, and modern authentication technologies. This role works closely with Security Operations, Governance Risk & Compliance, Infrastructure, Cloud, Application Development, Service Desk, and enterprise identity architecture teams.

This position is located onsite in Cary, NC and required to be in the office 3 days per week. We are hybrid, in office Tuesday/Wednesday/Thursday.

What You Need to Succeed

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field, or equivalent combination of education and experience is required.


• 3+ years of experience designing, implementing, and supporting IAM, PAM, and/or identity security solutions in large enterprise environments required.


• 2+ years of confident hands‑on experience administering CyberArk Privilege Cloud, CyberArk PAM, Delinea, BeyondTrust, and/or comparable PAM platforms highly preferred.


• Demonstrated ability to own and improve ZSP, JIT access, least privilege, RBAC, break-glass access, and privileged access reduction capabilities.


• Strong working knowledge of Microsoft Entra ID, Conditional Access, PIM, MFA, Identity Protection, directory services, and modern authentication controls.


• Confident understanding of SSO, federation, authentication, and authorization technologies such as SAML, OAuth 2.0, OIDC, LDAP, Active Directory, and cloud identity platforms.


• Capable of owning automation or integration work using PowerShell, Python, REST APIs, workflow automation, or similar scripting technologies is preferred.


• Proven ability to assess identity security risks, identify control gaps, recommend practical remediation, and communicate clearly with technical and non-technical stakeholders.


• Strong judgment, ownership mindset, sense of urgency, customer focus, business integrity, and ability to prioritize work in a fast-paced environment.


• Approximately 5% travel may be required in support of the position’s responsibilities.

What You Can Offer Us

• Design, implement, and support enterprise Identity Access Management (IAM) and Privileged Access Management (PAM) solutions across cloud, on-premises, and hybrid environments.


• Engineer privileged access capabilities including credential vaulting, password rotation, session management, privileged account onboarding, break‑glass access, and account lifecycle management.


• Advance ZSP, JIT access, least privilege, privileged access reduction, and RBAC initiatives.


• Implement and support Microsoft Entra ID capabilities including Conditional Access, Privileged Identity Management (PIM), multi‑factor authentication (MFA), Identity Protection, password less authentication, and access security controls.


• Design and support application access management, single sign‑on (SSO), federation, and modern authentication integrations using Security Assertion Markup Language (SAML), Open Authorization version 2.0 (OAuth 2.0), Open ID Connect (OIDC), Lightweight Directory Access Protocol (LDAP), and directory services.


• Secure privileged users, administrative accounts, service accounts, application identities, machine identities, agentic identities, and other non‑human identities.


• Partner with infrastructure, cloud, application, and platform teams to onboard systems, applications, servers, databases, endpoints, and cloud resources into PAM and identity security platforms.


• Develop and maintain privileged access standards, administrative access models, engineering runbooks, operational procedures, and Zero Trust access control patterns.


• Automate identity and privileged access processes using PowerShell, Python, REST APIs, workflow orchestration, and platform integrations.


• Troubleshoot IAM and PAM platform issues, perform root cause analysis, and implement corrective actions to improve reliability and operational stability.


• Collaborate with Security Operations to investigate identity‑related incidents, privileged access risks, control gaps, and suspicious activity involving high‑risk identities.


• Communicate identity security risks, technical recommendations, and remediation plans to cross‑functional teams, senior management, and business stakeholders.


• Other duties as assigned.

American Tower is a global digital infrastructure company serving customers through tower sites and other real estate solutions that support connectivity and opportunity, focused on achieving our vision of Building a More Connected World. Our success is rooted in the potential of our people and the power of local teams at our offices and sites across 25 countries.

We are one of the largest global Real Estate Investment Trusts (REITs) and a publicly traded (NYSE:AMT), Fortune 500 Company headquartered in Boston, Massachusetts. The next decade will be an exciting time as we evolve our infrastructure to meet tomorrow’s needs and position our people to elevate their impact, their potential, and our shared success. Come grow your career with us!

For more information about how American Tower is building a more connected world, visit americantower.com

American Tower is proud to be an equal opportunity employer and will not discriminate against an applicant or employee based on age, sex, sexual orientation, gender identity, race, color, creed, religion, national origin or ancestry, citizenship, marital status, familial status, disability, military or veteran status, genetic information, pregnancy, reproductive decisions, or any other characteristic protected under applicable law.

American Tower is committed to fair and equitable compensation practices. Placement within the salary range is based on a variety of factors, including relevant experience, skills, certifications, job level, and location. For U.S.-based candidates only, please see the base salary range for this position listed below. This position is also eligible for annual bonus, and annual equity award and participation in the Employee Stock Purchase Plan (ESPP). For candidates outside of the U.S., salary and benefits are based upon local market practice.

American Tower also offers a comprehensive benefits package, which includes healthcare coverage, a 401(k) savings plan, paid time off, company holidays, sick leave, parental leave, and access to an Employee Assistance Program focused on mental and financial wellness, please click here (https://www.americantower.com/us/careers/benefits) to learn more.

Requisition ID : 2896