Identiy and Access Management Engineer

essc; Irvine (CA); On-site; USD 101,000 - 126,000; Full time

Job summary

Easterseals Southern California is seeking an IAM Engineer to serve as the senior technical owner of identity services within a regulated healthcare environment. You will design, implement, and operate secure access controls for PHI-handling systems, overseeing lifecycle management, authentication, authorization, and governance across Okta, AD, and Entra ID.

You will partner with IT Security leadership to align identity controls with HIPAA, HITRUST, and internal requirements, while driving

Qualifications

• Bachelor’s degree in Information Technology, Information Security, or a related field, or equivalent practical experience.
• 7+ years in Identity & Access Management or a closely related information security role, including demonstrated ownership of identity platform design and implementation.

Responsibilities

• Own Okta as the primary identity platform - SSO, MFA and adaptive authentication policy, lifecycle management, and SaaS application access.
• Engineer identity integrations using SAML, OIDC/OAuth 2.0, and SCIM, including claims and expression logic, attribute mapping, and non-standard vendor implementations.
• Design and implement Okta lifecycle workflows automating joiner, mover, and leaver processes from Workday through Okta, Entra ID, Active Directory, and downstream applications.
• Own the enterprise Privileged Access Management platform, including credential vaulting and rotation, session management and session recording, and secrets management.

Skills

SSO

MFA

Adaptive authentication

Passwordless

SAML

OIDC/OAuth 2.0

Identity governance

Workday to Okta integration

Education

Bachelor's degree in Information Technology or related field

Tools

Okta

Active Directory

Microsoft Entra ID

PAM platforms (Delinea/BeyondTrust/CyberArk)

Workday

Job description

Easterseals Southern California transforms lives every day. For over a century, Easterseals has championed inclusion and independence-delivering essential services like early childhood programs, autism services, employment and independent living support to more than 29,000 people each year. Through advocacy and education, we break barriers and create opportunities for the one-in-four Americans with disabilities.

The Identity & Access Management (IAM) Engineer is the senior technical owner of identity services in a regulated healthcare environment, responsible for designing, implementing, and operating secure access controls for systems handling Protected Health Information (PHI). The role leads identity lifecycle management, authentication and authorization, application integration, privileged access management, and identity governance across Active Directory, Okta, and Microsoft Entra ID. Working independently, the IAM Engineer defines identity standards, access control models, and integration patterns; reduces privileged access risk through PAM and just-in-time access; and serves as the senior escalation point for authentication and federation issues. The role partners with IT Security leadership to ensure identity controls align with HIPAA, HITRUST, and internal security requirements. In all responsibilities, the position demonstrates a strong commitment to ESSC's mission and values by supporting a safe, compliant, and responsive workplace injury management process.

Hiring Salary Range: $101k - $126k / yr.

OVERVIEW

The Identity & Access Management (IAM) Engineer is the senior technical owner of identity services in a regulated healthcare environment, responsible for designing, implementing, and operating secure access controls for systems handling Protected Health Information (PHI). The role leads identity lifecycle management, authentication and authorization, application integration, privileged access management, and identity governance across Active Directory, Okta, and Microsoft Entra ID. Working independently, the IAM Engineer defines identity standards, access control models, and integration patterns; reduces privileged access risk through PAM and just-in-time access; and serves as the senior escalation point for authentication and federation issues. The role partners with IT Security leadership to ensure identity controls align with HIPAA, HITRUST, and internal security requirements. In all responsibilities, the position demonstrates a strong commitment to ESSC's mission and values by supporting a safe, compliant, and responsive workplace injury management process.

ESSENTIAL FUNCTIONS

• Own Okta as the primary identity platform - SSO, MFA and adaptive authentication policy, lifecycle management, and SaaS application access - and advance the organization toward passwordless, phishing-resistant authentication (FastPass, FIDO2/WebAuthn, certificate-based authentication). 25%
• Engineer identity integrations using SAML, OIDC/OAuth 2.0, and SCIM, including claims and expression logic, attribute mapping, and non-standard vendor implementations. 25%
• Design and implement Okta lifecycle workflows automating joiner, mover, and leaver processes from Workday through Okta, Entra ID, Active Directory, and downstream applications. 25%
• Own the enterprise Privileged Access Management platform, including credential vaulting and rotation, session management and session recording, and secrets management. 25%

Total 100%

QUALIFICATIONS, EDUCATION, EXPERIENCE

• Required Minimum Education - Bachelor's degree in Information Technology, Information Security, or a related field, or equivalent practical experience.
• Preferred Education - None
• Required Certifications or Licenses - None
• Minimum Experience - 7+ years in Identity & Access Management or a closely related information security role, including demonstrated ownership of identity platform design and implementation.

KNOWLEDGE, SKILLS, ABILITIES

• Demonstrated technical expertise architecting, securing, and troubleshooting Okta - SSO, MFA and adaptive authentication policy, passwordless and phishing-resistant authentication, lifecycle management, and Okta Workflows.
• Demonstrated technical expertise architecting, securing, and troubleshooting Active Directory and Microsoft Entra ID - hybrid identity synchronization, OU and delegation models, Kerberos and LDAP authentication flows, AD replication and FSMO troubleshooting, and privileged tier models with administrative account separation.
• Demonstrated technical expertise architecting, securing, and troubleshooting enterprise PAM platforms (Delinea, BeyondTrust, CyberArk, or equivalent) - credential vaulting and rotation, session management, secrets management, and just