Principal IAM Engineer

Lantern; Dallas (TX); Hybrid; USD 140,000 - 210,000; Full time

Job summary

Lantern, a specialty care platform, is hiring a Principal IAM Engineer. You will own the identity control plane end-to-end, design the identity standard, and drive automation across platform, cloud, and service delivery teams. This hands-on role reports to the CISO with growth potential as the identity function expands.

Hybrid role with at least 3 days per week in our Dallas, TX office. The security model is open by default, secure by design, enabling rapid business progress while maintaining

Qualifications

• Experience implementing IAM architectures and security controls.
• Strong understanding of identity governance, RBAC/ABAC, and access management.
• Familiarity with Entra ID, SAML, OIDC, OAuth2 and federated identity.

Responsibilities

• Own the identity lifecycle: joiner, mover, leaver provisioning and deprovisioning, automated from role- and attribute-based models.
• Own access management, including Conditional Access, MFA, and privileged access in a Zero Trust model.
• Own directory and federation across Entra ID, SSO, SAML, OIDC, OAuth2.
• Own secrets/non-human identities including API keys and service accounts; maintain owner registry.
• Own key access governance and separation of duties with another team handling key management.
• Own identity automation/identity-as-code with Terraform and policy-as-code.
• Own the identity-verification standard for password/MFA resets and device enrollment.
• Key Deliverables in Your First Year: Conditional Access for PHI-facing apps; automated lifecycle provisioning; a secrets golden path; MFA coverage on privileged accounts.

Job description

Lantern is the specialty care platform connecting people with the best care when they need it most. By curating a Network of Excellence comprised of the nation's top specialists for surgery, cancer care, infusions and more, Lantern delivers excellent care with significant cost savings to employers and their workforces. Lantern also pairs members with a dedicated care team, including Care Advocates and nurses, for the entirety of their care journey, helping them get back to good health, back to their families and back to work. With convenient access to specialists nationwide, Lantern means quality care is within driving distance for most. Lantern is trusted by the nation's largest employers to deliver care to more than 6 million members across the country. Learn more about us at lanterncare.com.

Lantern is the specialty care platform, connecting people with high-quality, affordable specialty care close to home. We operate in a regulated healthcare environment (HIPAA, HITRUST, SOC 2), we handle protected health information at scale, and we are becoming an AI healthcare company, with AI adoption a top company priority.

This Principal IAM Engineer is a senior level, individual-contributor role and the technical authority for identity at Lantern. In an organization where the security perimeter is effectively identity, you will own the identity control plane end to end, and you will determine who can reach PHI and under what conditions. You will set the identity standard, build the automation behind it, and hold the verification bar that other teams operate against.

You will report to the CISO and partner closely with our IAM engineer and with the platform, cloud, and service delivery teams that execute alongside you. This is a hands-on principal seat, not a people-management role today, with a clear path to expand into a leadership role as the identity function grows.

Our security philosophy is open by default, secure by design. Security exists to help the business move fast, safely, and the default answer is “yes, safely,” because guardrails are built into the platform, pipelines, and tooling rather than enforced by someone saying no. Gates exist only where risk genuinely warrants them, and even then they are automated, fast, and transparent.

Location: Hybrid - at least 3 days/wk in our Dallas, TX offices

Responsibilities:

• Own the identity lifecycle: joiner, mover, and leaver provisioning and deprovisioning, automated from role- and attribute-based models (RBAC/ABAC), with deprovisioning verified against an entitlement inventory rather than assumed.
• Own access management, including Conditional Access, phishing-resistant MFA, and privileged access on a Zero Trust model, with least-privilege by default, just-in-time (JIT) elevation, and enforcement confirmed on every access path rather than only saved.
• Own directory and federation across Entra ID, single sign-on, SAML, OIDC, and OAuth2.
• Own secrets and non-human identity, including API keys, service accounts, and workload identity, and maintain an owner registry for them.
• Own key access governance and separation of duties in a model where another team operates the key management system.
• Own identity automation and identity-as-code, building lifecycle and access controls as reviewable, version-controlled infrastructure (Terraform and policy-as-code) rather than manual configuration.
• Own the identity-verification standard the service desk follows for password resets, MFA resets, and device enrollment. This is a hands-on control point, because helpdesk-initiated resets are a leading account-takeover vector.

Key Deliverables in Your First Year:

• Conditional Access enforced by default on PHI-facing applications, with enforcement verified.
• Automated joiner, mover, and leaver provisioning and deprovisioning that meets its SLA every time.
• A secrets golden path, with vaulted secrets, none in code, and a populated key-to-owner registry.
• Strong, phishing-resistant MFA coverage on privileged accounts.
<