Senior IAM Architect: Zero-Trust & SSO Leader

Subway; Shelton (CT); Hybrid; USD 140,000 - 190,000; Full time

Benefits offered by this job

Insurance Plans (Medical, Life)

Pension/401K/RSP

Competitive Bonus

Mobility Allowance

Tuition Reimbursement

Company Holidays

Volunteering time

Job summary

Franchise World Headquarters, LLC in Shelton, CT is seeking a Sr. IAM Engineer to lead engineering, security, and evolution of Subway's identity platform. You will own federation, provisioning, and access governance across Okta, Entra ID, AD, M365, ServiceNow, and multiple SaaS apps.

The role demands senior expertise in OAuth/OIDC, SAML 2.0, and SCIM, with hands-on scripting in PowerShell, Python, and Bash. Join a team driving identity governance and CI/CD powered automations.

Qualifications

• 7+ years in identity and access management with senior ownership.
• Deep OAuth 2.0, OIDC, and SAML 2.0 protocol knowledge.
• Hands-on Okta admin and SCIM provisioning in a large enterprise.

Responsibilities

• Engineer and operate Okta as identity broker and SSO provider.
• Manage SCIM provisioning and hybrid AD/Entra ID integrations.
• Enforce zero-trust, least privilege, and MFA across services.
• Secure identity for AI systems and non-human identities.
• Automate joiner/mover/leaver workflows via HRIS events.
• Own day-to-day IAM operations, incident response, and audits.
• Mentor engineers and contribute to IAM roadmap.

Skills

IAM engineering

OAuth 2.0 / OIDC

SAML 2.0

Okta administration

PowerShell

Python

CI/CD

SCIM provisioning

Azure AD / Entra ID

Education

Bachelor's degree in CS/IT or equivalent

Tools

Okta

SCIM

Entra ID / Azure AD

Git

Terraform

CrowdStrike

Job description

Franchise World Headquarters, LLC in Shelton, CT is seeking a Sr. IAM Engineer to lead engineering, security, and evolution of Subway's identity platform. You will own federation, provisioning, and access governance across Okta, Entra ID, AD, M365, ServiceNow, and multiple SaaS apps.

The role demands senior expertise in OAuth/OIDC, SAML 2.0, and SCIM, with hands-on scripting in PowerShell, Python, and Bash. Join a team driving identity governance and CI/CD powered automations.