Lead IAM Engineer

Blue Cross and Blue Shield of Massachusetts, Inc.; Boston (MA); On-site; USD 163,530 - 199,870; Full time

Benefits offered by this job

Paid time off

Medical insurance

Dental insurance

Vision insurance

401(k)

Job summary

Blue Cross and Blue Shield of Massachusetts, Inc. seeks a Lead IAM Engineer to be the senior technical authority for enterprise IAM. You will design, build, and automate IAM across workforce, privileged, machine, application, and cloud identities, mentoring engineers and shaping engineering standards.

The role emphasizes modernizing IAM, integrating security controls into CI/CD, and guiding architecture decisions. Boston or Hingham offices preferred; on-site work expected.

Qualifications

• 8+ years of dedicated IAM engineering experience.
• Experience leading IAM initiatives in hybrid, multi-cloud, and SaaS environments.
• Expert‑level knowledge of SAML, OAuth 2.0, OpenID Connect.
• Hands‑on experience with enterprise IAM platforms (Ping, Delinea, SailPoint, Entra ID).
• Deep automation of Identity Governance (JML) and PAM controls.
• Proficient in scripting (Python, PowerShell, Terraform).
• Certifications such as CISSP, CISM, CCSP preferred.

Responsibilities

• Design and implement IAM solutions across SSO, MFA, IGA, PAM, and cloud identity platforms.
• Build integrations between IAM platforms and enterprise applications.
• Support onboarding applications into IAM services.
• Develop automation using Python, PowerShell, Terraform, APIs, and workflow engines.
• Mentor IAM engineers and conduct design/code reviews.
• Support audits and risk remediation, establish engineering standards.

Skills

IAM leadership

Identity protocols

CI/CD integration

Multi-cloud IAM

Automation scripting

Education

Bachelor's in CS/Engineering

Tools

Ping

Delinea

SailPoint

Entra ID

Job description

Ready to help us transform healthcare? Bring your true colors to blue.

We are seeking a highly experienced Lead IAM Engineer to serve as the senior technical authority for enterprise Identity and Access Management. This role will lead the design, engineering, automation, and operational maturity of IAM capabilities across workforce, privileged, machine, application, and cloud identities.

The ideal candidate combines deep technical expertise with architectural thinking and hands‑on engineering execution. This individual will drive modernization initiatives, mentor engineers, establish engineering standards, and partner with business and technology teams to strengthen the organization's identity security posture.

This role is eligible for our Flex persona, with candidates local to our Boston, MA or Hingham, MA offices preferred.

Your Day to Day

• Design and implement IAM solutions across SSO, MFA, IGA, PAM, and cloud identity platforms.
• Build integrations between IAM platforms and enterprise applications.
• Support onboarding applications into IAM services.
• Create reference architectures and design patterns.
• Review application architectures and provide IAM guidance.
• Develop enterprise standards for authentication, authorization, and privileged access.
• Support Zero Trust initiatives.
• Develop automation using Python, PowerShell, Terraform, APIs, and workflow engines.
• Act as escalation point for IAM production issues.
• Lead troubleshooting of complex authentication and provisioning failures.
• Perform root cause analysis and remediation.
• Improve platform resiliency and automation.
• Mentor IAM engineers and administrators.
• Conduct design reviews and code reviews.
• Establish engineering standards and best practices.
• Guide teams on IAM implementation patterns.
• Support audits and compliance initiatives.
• Assist with risk remediation efforts.
• Evaluate emerging IAM technologies and develop IAM roadmaps.
• Identify automation opportunities and drive modernization efforts.

This document is not an exhaustive list of all responsibilities, skills, duties, requirements, or working conditions associated with the job. Employees may be required to perform other job‑related duties.

We're Looking for Someone Who

• Acts as the principal technical expert and subject matter expert for the IAM engineering team.
• Leads the technical design and hands‑on implementation of identity solutions across SSO, MFA, IGA, and PAM platforms.
• Drives the technical execution of Zero Trust architecture and the integration of identity controls directly into CI/CD pipelines (DevSecOps).
• Secures complex federated identities, APIs, and non‑human workload identities across multi‑cloud environments (AWS, Azure, GCP).
• Provides formal mentorship, technical oversight, and architectural guidance to all other IAM engineers on the team.
• Leads the engineering response to critical identity platform outages, performing deep root cause analysis on systemic bugs and performance issues.
• Demonstrates influence and business skills by serving as the principal technical expert, driving complex architectural decisions, and leading advanced identity methodologies without carrying direct people‑management responsibilities.
• Establishes and evangelizes IAM engineering best practices, including secure coding standards, design patterns, and reusable automation libraries.

What You Bring

• Bachelor's in CS/Engineering preferred, with 8+ years of dedicated IAM engineering experience.
• Demonstrated experience leading complex IAM initiatives supporting hybrid, multi‑cloud, and SaaS environments.
• Expert‑level knowledge of modern identity protocols (SAML, OAuth 2.0, OpenID Connect).
• Advanced, hands‑on experience engineering leading platforms (e.g., Ping, Delinea, SailPoint, Entra ID) for enterprise‑wide scale.
• Deep expertise in automating Identity Governance (JML processes) and deploying modern PAM controls (credential vaulting, Just‑in‑Time access).
• Strong proficiency in scripting/automation (Python, PowerShell, Terraform).
• Relevant industry certifications (e.g., CISSP, CISM, CCSP, or vendor‑specific IAM certs) are strongly preferred.

Minimum Education Requirements

High school degree or equivalent required unless otherwise noted above.

Location

Boston, MA or Hingham, MA.

Time Type

Full time

Salary Range

$163,530.00 - $199,870.00

We offer comprehensive package of benefits including paid time off, medical, dental, vision insurance, 401(k), and a suite of well‑being benefits to eligible employees.

Note: No amount of pay is considered to be wages or compensation until such amount is earned, vested, and determinable. The amount and availability of any bonus, commission, or any other form of compensation that are allocable to a particular employee remains in the Company’s sole discretion unless and until paid and may be modified at the Company’s sole discretion, consistent with the law.