Senior Engineer, Workforce IAM

Jobgether; United States; Remote; USD 125,000 - 179,000; Full time

Benefits offered by this job

Medical Insurance

Dental and Vision Insurance

Remote Work Flexibility

Paid Time Off

401(k) Retirement Savings

Job summary

Jobgether is seeking a Senior Engineer, Workforce IAM to design and evolve enterprise IAM across hybrid and multi-cloud environments in the United States. You will lead identity governance, SSO, and lifecycle automation while collaborating with security, HR, and application teams.

You will champion Zero Standing Privilege, Just-in-Time access, and non-human identity management, shaping security standards and scalable solutions in a fast-paced, highly regulated healthcare environment.

Qualifications

• Bachelor's degree in CS/IT or related field or equivalent experience.
• 10+ years in information security and IAM disciplines, with lead/principal experience.
• Experience designing and governing enterprise IAM in hybrid/multi-cloud environments.
• Deep knowledge of OAuth 2.0, OIDC, SAML 2.0, SCIM 2.0, and FIDO2/WebAuthn.
• Proven experience with enterprise identity providers like Microsoft Entra ID and Okta.

Responsibilities

• Define and maintain enterprise IAM standards, reference architectures, and blueprints (SSO, IGA, directory services, lifecycle management).
• Lead IAM workstreams for mergers, acquisitions, and divestitures with repeatable integration workflows.
• Design cross-domain federation strategies and integrate providers (Microsoft Entra ID, Okta, Ping).
• Architect secure identity integrations across on-prem AD/ADFS and cloud (Azure, AWS, GCP).
• Develop and implement ZSP/JIT and PAM strategies (CyberArk, Vault).
• Implement policy-driven access models and lifecycle governance for HIPAA, SOX, GDPR compliance.
• Automate onboarding, role changes, and offboarding via HR-integrated workflows (Workday, SuccessFactors).
• Configure identity connectors (AD, JDBC, REST/SOAP) and provisioning (SailPoint).
• Create non-human identity solutions (RFID, biometric, AI-enabled security controls).
• Contribute to architecture governance, documentation, and mentoring of engineers.

Skills

IAM Architecture

OAuth 2.0

OIDC

SAML 2.0

FIDO2/WebAuthn

Microsoft Entra ID

Okta

CyberArk

HashiCorp Vault

SailPoint

Multi-Cloud

Education

Bachelor's degree in CS/IT or related field

Tools

Active Directory

ADFS

SailPoint

CyberArk

HashiCorp Vault

Job description

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Engineer, Workforce IAM based in the United States.

As a Senior Engineer, Workforce IAM, you will design and evolve enterprise identity and access management solutions that protect a large, globally distributed workforce and critical business operations. You will lead complex identity architecture initiatives across hybrid and multi-cloud environments, strengthening authentication, access governance, and privileged access controls. A key focus will be accelerating identity integration during mergers, acquisitions, and divestitures while modernizing legacy platforms and improving operational resilience. You will champion Zero Standing Privilege, automated identity lifecycle management, and emerging technologies for human and non-human identities. Working closely with security, IT, HR, and application teams, you will establish enterprise-wide standards that balance robust protection with seamless user experiences. This role offers the opportunity to influence long-term security strategy, mentor technical colleagues, and deliver scalable identity solutions in a fast-paced, highly regulated healthcare environment.

Accountabilities

• Enterprise IAM Architecture: Define and maintain enterprise identity and access management standards, reference architectures, and technical blueprints covering Single Sign-On (SSO), Identity Governance and Administration (IGA), directory services, and identity lifecycle management.
• Mergers, Acquisitions, and Divestitures: Lead IAM architecture and technical workstreams for corporate integrations and separations. Develop repeatable integration frameworks that accelerate identity discovery, user migration, directory consolidation, and authentication integration across acquired or divested entities.
• Identity Federation and Directory Consolidation: Design and implement cross-domain and cross-cloud federation strategies, B2B collaboration frameworks, and tenant boundary governance. Integrate and consolidate identity providers such as Microsoft Entra ID, Okta, and Ping across complex enterprise environments.
• Hybrid and Multi-Cloud Security: Architect secure identity integrations between on-premises infrastructure, including Active Directory and ADFS, and cloud environments such as Microsoft Azure, AWS, and Google Cloud Platform. Ensure secure interoperability with SaaS applications and enterprise identity platforms.
• Privileged Access Management: Develop and implement Zero Standing Privilege (ZSP) and Just-in-Time (JIT) access strategies using Privileged Access Management solutions such as CyberArk and HashiCorp Vault. Expand Cloud Infrastructure Entitlement Management capabilities to continuously identify and eliminate excessive permissions.
• Identity Governance and Administration: Design and implement policy-driven access models, including role-based and policy-based access control, automated segregation-of-duties frameworks, and governance processes that support regulatory compliance and appropriate access privileges.
• Identity Lifecycle Automation: Integrate authoritative HR systems, including Workday, SuccessFactors, and PeopleSoft, with IAM platforms to automate employee onboarding, role changes, and offboarding. Establish birthright provisioning, request-based access workflows, and reliable lifecycle automation.
• Application Integration and Provisioning: Design, develop, and configure identity connectors for Active Directory, JDBC, and REST/SOAP web services. Support application onboarding, automated provisioning, and self-service access management through platforms such as SailPoint.
• Frontline and Non-Human Identity Solutions: Architect specialized authentication experiences for frontline employees and operational facilities, including contactless RFID badges, biometric FIDO2 smart cards, and shared-kiosk sessions. Develop strategies for non-human identity management and emerging AI-related security requirements.
• Emerging Identity Security Technologies: Evaluate and incorporate new capabilities in Non-Human Identity Management (NHIM), Identity Security Posture Management (ISPM), and AI-driven security controls into the enterprise IAM roadmap.
• Automation and Infrastructure as Code: Develop API-driven automation and infrastructure-as-code practices to reduce manual provisioning, improve consistency, and increase the reliability and scalability of identity configurations.
• Security, Risk, and Compliance: Ensure IAM solutions comply with applicable requirements, including HIPAA, SOX IT General Controls, GDPR, and relevant data sovereignty frameworks. Maintain auditable access records, enforce internal security policies, and reduce risks associated with unauthorized access.
• Operational Resilience and Continuous Improvement: Collaborate with IAM engineering teams to establish automated remediation and self-healing provisioning capabilities, targeting high availability for critical identity services. Identify opportunities to strengthen system reliability and reduce operational friction.
• Vendor and Architecture Governance: Evaluate vendor proposals, review Statements of Work for complex migrations, challenge proposed integration approaches, and establish appropriate strategies for legacy platform decommissioning.
• Cross-Functional Leadership: Partner with Information Security, IT Operations, HR, application development, and business stakeholders to align identity solutions with organizational requirements. Translate complex technical and cryptographic concepts into clear security risks and business decisions.
• Technical Documentation and Mentorship: Maintain architecture diagrams, configuration standards, implementation guides, and operational procedures. Mentor less experienced engineers and contribute to the development of IAM policies, practices, and performance metrics.

Requirements

• Education: Bachelor's degree in Computer Science, Information Technology, Information Security, or a related field, or equivalent practical experience.
• Professional Experience: At least 10 years of experience in information security and identity management, including five or more years operating as a Lead or Principal Enterprise IAM Architect. Experience in a large enterprise or Fortune 500 environment is preferred.
• Enterprise IAM Architecture: Extensive experience designing, implementing, and governing enterprise identity solutions across complex organizational structures, hybrid infrastructure, and multi-cloud environments.
• Identity Protocols and Standards: Deep theoretical and practical knowledge of OAuth 2.0, OpenID Connect (OIDC), SAML 2.0, SCIM 2.0, FIDO2/WebAuthn, and Kerberos.
• Identity Provider Expertise: Strong architectural experience with enterprise identity providers, particularly Microsoft Entra ID and Okta, including SSO, federation, authentication, and directory integration.
• IGA and PAM Platforms: Demonstrated expertise with Identity Governance and Administration platforms such as SailPoint IdentityIQ or Identity Security Cloud, as well as privileged access solutions such as CyberArk and HashiCorp Vault.
• M&A Identity Integration: Proven experience leading identity discovery, tenant consolidation, domain migrations, user and attribute mapping, and identity provider integration during mergers, acquisitions, or divestitures.
• Hybrid and Multi-Cloud Security: Strong understanding of Active Directory, ADFS, Azure, AWS, Google Cloud Platform, SaaS identity integrations, and cross-cloud federation architectures.
• Identity Governance and Lifecycle Management: Experience designing automated joiner-mover-leaver processes, birthright provisioning, access certification, role-based and policy-based access controls, segregation-of-duties controls, and authoritative source integrations.
• Privileged Access and Cloud Entitlements: Knowledge of Zero Standing Privilege, Just-in-Time access, privileged access governance, and Cloud Infrastructure Entitlement Management, including strategies for reducing excessive permissions.
• Automation and Development: Experience implementing API-driven workflows, identity connectors, provisioning automation, and infrastructure-as-code practices. Familiarity with REST/SOAP integrations and enterprise automation patterns is valuable.
• Regulatory and Compliance Knowledge: Comprehensive understanding of SOX 404 IT General Controls, the HIPAA Security Rule, GDPR, and international data sovereignty considerations.
• Emerging Security Technologies: Ability to assess and incorporate evolving identity security practices, including non-human identity management, identity security posture management, and AI-related access controls.
• Strategic and Analytical Thinking: Strong problem-solving skills and the ability to design scalable solutions for complex technical challenges, evaluate architectural trade-offs, and establish standards that support long-term enterprise objectives.
• Communication and Stakeholder Management: Excellent communication skills, executive presence, and the ability to explain sophisticated identity and cryptographic concepts in terms of business risk, operational impact, and security outcomes.
• Project and Change Management: Ability to lead complex, high-impact technical initiatives, manage competing priorities, meet demanding deadlines, and operate effectively in a fast-moving M&A environment.
• Leadership and Mentorship: Demonstrated ability to influence technical direction, establish best practices, guide cross-functional teams, and mentor engineers while working independently with guidance on overall objectives.
• Adaptability and Continuous Learning: Commitment to staying current with evolving IAM technologies, cybersecurity threats, regulatory requirements, and enterprise security best practices.

Benefits

• Competitive Salary: Anticipated annual salary range of $125,300–$178,900, depending on experience, qualifications, geographic location, and internal pay equity.
• Performance-Based Incentives: Eligibility for a bonus in addition to base salary.
• Medical Coverage: Access to medical insurance options designed to support employee health and well-being.
• Dental and Vision Insurance: Coverage options for dental and vision care.
• Paid Time Off: Paid time off to support personal needs, vacation, and work-life balance.
• Retirement Savings: 401(k) savings plan to support long-term financial planning.
• Health Savings Account: HSA options to help manage eligible healthcare expenses.
• Flexible Spending Accounts: FSAs for eligible healthcare and dependent-care expenses, subject to plan availability.
• Early Wage Access: Access to earned wages before payday through the myFlexPay program.
• Disability Coverage: Short-term and long-term disability benefits.
• Paid Parental Leave: Paid leave to support employees and their families during significant life events.
• Work-Life Resources: Access to resources and programs supporting personal well-being and work-life balance.
• Healthy Lifestyle Programs: Wellness initiatives designed to encourage healthy habits and overall well-being.
• Remote Work Flexibility: Nationwide remote work opportunities within the United States.
• Professional Growth: Opportunities to influence enterprise security architecture, work on large-scale identity transformation projects, and mentor technical colleagues.
• Inclusive Workplace: A commitment to equal employment opportunities and a culture that values diverse backgrounds, perspectives, and experiences.