Identity Security Engineer — IAM, PAM & Zero Trust

American Tower; Cary (NC); On-site; USD 130,000 - 170,000; Full time

Job summary

American Tower is seeking an Identity Security Engineer to strengthen identity security across cloud, on‑prem, and hybrid environments. You will implement Zero Trust concepts, RBAC, and Just-In-Time access while reducing privileged access risks.

The role is onsite in Cary, NC with a hybrid schedule requiring in-office presence Tuesday through Thursday. You will collaborate with Security Operations, Infrastructure, and application teams to secure enterprise identities.

Qualifications

• Bachelor’s degree in Cybersecurity, IT, Computer Science, Engineering, or related field or equivalent.
• 3+ years designing, implementing, and supporting IAM, PAM in large enterprises.
• 2+ years administering CyberArk Privilege Cloud, CyberArk PAM, Delinea, BeyondTrust.
• Experience with ZSP, JIT, least privilege, RBAC, break-glass access.
• Strong knowledge of Microsoft Entra ID, Conditional Access, PIM, MFA, Identity Protection, directory services, modern authentication.
• Understanding SSO, federation, authentication, and authorization technologies (SAML, OAuth 2.0, OIDC, LDAP, AD).
• Automation using PowerShell, Python, REST APIs.
• Ability to assess identity security risks and communicate with stakeholders.
• Approximately 5% travel possible.

Responsibilities

• Design and support IAM and PAM across cloud, on-prem, and hybrid environments.
• Engineer privileged access capabilities including vaulting, rotation, session management, onboarding, break‑glass access, lifecycle management.
• Advance ZSP, JIT access, least privilege, privileged access reduction, and RBAC initiatives.
• Implement and support Microsoft Entra ID capabilities including CA, PIM, MFA, Identity Protection, passwordless authentication, and access controls.
• Design and support SSO, federation, and modern authentication integrations using SAML, OAuth 2.0, OIDC, LDAP.
• Secure privileged and non-human identities and onboard systems to PAM platforms.
• Collaborate with infrastructure, cloud, application, and platform teams to onboard assets to PAM and identity security platforms.
• Develop and maintain privileged access standards and runbooks.

Skills

IAM

PAM

CyberArk

Entra ID

MFA

SSO/OIDC

PowerShell

Python

RBAC

Zero Trust

Education

Bachelor’s degree in Cybersecurity/IT/CS/Engineering

Tools

Delinea

BeyondTrust

Job description

American Tower is seeking an Identity Security Engineer to strengthen identity security across cloud, on‑prem, and hybrid environments. You will implement Zero Trust concepts, RBAC, and Just-In-Time access while reducing privileged access risks.

The role is onsite in Cary, NC with a hybrid schedule requiring in-office presence Tuesday through Thursday. You will collaborate with Security Operations, Infrastructure, and application teams to secure enterprise identities.