Senior Identity & Access Management Engineer

GreatAmerica Bank National Association; Cedar Rapids (IA); Hybrid; USD 120,000 - 150,000; Full time

Benefits offered by this job

Health Insurance

Hybrid work arrangements

401(k) and Company Match

Paid Time Off

Tuition Assistance

Job summary

GreatAmerica Financial Services is seeking a Senior IAM Engineer to design, implement, and enhance identity governance, access management, and privileged access capabilities across the organization. You will work across SailPoint, Okta, and CyberArk, delivering automated identity lifecycle processes, RBAC models, and secure authentication services.

Collaborating with Security, Audit, Compliance, Infrastructure, and Application teams, you will advance automation, governance maturity, and

Qualifications

• 5+ years in Identity and Access Management engineering/administration roles.
• 3+ years with SailPoint IdentityIQ/IdentityNow (workflows, cert campaigns, connectors).
• RBAC design experience including role mining/engineering and lifecycle governance.
• Experience with CyberArk PAM—vaulting, session isolation, privileged onboarding.
• Strong PowerShell and REST API automation for entitlement, reconciliation, audit evidence.

Responsibilities

• Build automated identity lifecycle workflows and connectors in SailPoint IdentityNow/IdentityIQ.
• Design and roll out RBAC models with ongoing governance.
• Manage Okta as enterprise identity provider for SSO, MFA, and SCIM provisioning.
• Implement and support CyberArk PAM and privileged access onboarding.
• Automate JML provisioning and deprovisioning across enterprise systems.

Skills

IAM engineering

SailPoint (IdentityIQ/IdentityNow)

RBAC design

CyberArk PAM

Okta SSO/MFA/SCIM

PowerShell scripting

REST API automation

Education

Bachelor's degree in cybersecurity/computer science or related field

Tools

SailPoint IdentityNow/IdentityIQ

Okta

CyberArk

ServiceNow

Job description

GreatAmerica Financial Services is a highly successful entrepreneurial company providing equipment financing to businesses across the United States. Our exemplary customer service, our principle-centered business philosophy and our team-based operating approach are key to our success and growth. We are looking to add a key member to our Identity & Access Management Team! The Senior Identity & Access Management (IAM) Engineer is responsible for designing, implementing, and continuously enhancing GreatAmerica's identity governance, access management, and privileged access capabilities. This role serves as a senior technical specialist, ensuring identity and access controls are secure, scalable, automated, and aligned with regulatory, audit, and risk management requirements.

Working across SailPoint, CyberArk, Okta, and related technologies, the Senior IAM Engineer develops and maintains enterprise identity lifecycle processes, role-based access controls, privileged access solutions, and authentication services. The role partners closely with Security, Audit, Compliance, Infrastructure, and Application teams to translate security and control requirements into effective technical solutions while advancing automation, operational efficiency, and governance maturity.

The Senior IAM Engineer plays a key role in strengthening GreatAmerica's identity security program by improving access governance, supporting regulatory compliance, reducing access-related risk, and ensuring the reliability and effectiveness of identity services across the organization.

As a Senior IAM Engineer, you will:

• Build and maintain automated identity lifecycle workflows, certification campaigns, and connectors within SailPoint IdentityNow, including connector development and integration with enterprise applications (ServiceNow, ILS).
• Design, build, and roll out role-based access control (RBAC) models, including role mining, role engineering, and ongoing role lifecycle governance.
• Integrate and administer Okta as the enterprise identity provider, including single sign-on (SSO), multi-factor authentication (MFA), and lifecycle management through SCIM provisioning.
• Implement and support CyberArk privileged access management (PAM), including credential vaulting, session isolation and monitoring, just-in-time (JIT) elevation policy administration, elimination of standing privileges, and privileged account onboarding.
• Support the migration from self-hosted CyberArk PAS to CyberArk Privilege Cloud, report and integration transition, and updates to operational procedures.
• Develop self-service and automated access request workflows spanning request intake, approval routing, and fulfillment.
• Automate joiner, mover, and leaver (JML) provisioning and deprovisioning processes across enterprise systems to ensure timely and accurate access changes.
• Execute recurring access certification campaigns and quarterly configuration reviews (privileged access, password and authentication settings), producing audit-ready evidence for ICFR logical access controls.
• Support SOX-related access controls, segregation of duties (SoD) enforcement, and the generation of audit evidence for Internal Control over Financial Reporting (ICFR).
• Develop PowerShell and REST API automation for entitlement extracts, reconciliation, reporting, and audit evidence generation.
• Apply FFIEC IT examination handbook guidance to identity governance, access control design, and third-party access risk.
• Partner with security, audit, compliance, and application teams to translate control requirements into engineered, testable technical solutions.
• Troubleshoot, tune, and document IAM integrations and workflows to ensure reliability, performance, and auditability.

To be successful, you will need:

• Required 5+ years of hands-on experience in Identity and Access Management engineering or administration roles.
• 3+ years of direct, hands-on experience with SailPoint (IdentityIQ and/or IdentityNow), including lifecycle workflows, certification campaigns, and connector development or integration.
• Demonstrated experience designing and deploying RBAC models, including role mining, role engineering, and role lifecycle governance.
• Working experience with CyberArk PAM, including vaulting, session isolation and monitoring, and privileged account onboarding.
• Strong PowerShell scripting and REST API experience for automation, entitlement extracts, reconciliation, and audit evidence generation.
• Proven ability to build access request automation covering requests, approvals, and fulfillment.
• Experience automating JML provisioning and deprovisioning across multiple enterprise systems.
• Preferred Practical experience integrating and administering Okta as an identity provider, including SSO, MFA, and SCIM-based lifecycle provisioning (depth in two of SailPoint / CyberArk / Okta required; ability to develop depth in the third).
• Experience in a financial services environment, with a solid understanding of the regulatory and control landscape applicable to banking or financial institutions.
• Experience supporting ICFR and SOX access controls, including segregation of duties and audit evidence preparation.
• Familiarity with FFIEC IT examination guidance as it relates to identity governance and logical access.
• Education Bachelor's degree with a major in cybersecurity, computer science or related field preferred, but not required. Information security experience may be substituted for requisite education.
• Certifications Preferred, not required: SailPoint Certified IdentityNow/IdentityIQ Engineer; CyberArk Defender or Sentry; Okta Certified Professional or Administrator; CISSP or equivalent.

Sharing rewards is an integral part of our culture. We believe in the value of hard work and reward our employees beyond the paycheck. Our total rewards package is based on eligibility and includes:

• Financial Benefits Competitive Compensation Monthly Bonuses for Eligible Employees
• 401(k) and Company Match Annual Profit Sharing
• Paid Time Off
• Health, Wellbeing, and Family Planning Benefits
• Paid Vacation - starting at 80 hours annually for employees in their first year of service.
• Paid Sick Days - Ten (10) per year with a conversion option for unused time.
• Ten (10) Paid Holidays per year
• Gym Reimbursement
• Health Insurance
• Dental Insurance
• Vision Insurance
• Short-Term and Long Term Disability
• Company Paid Life Insurance
• Flexible Spending Accounts (FSA)
• Health Savings Accounts (HSA)
• Employee Assistance Program
• Parental Leave
• Education and Career Planning Benefits
• Tuition Assistance
• Networking Opportunities
• Leadership Development Opportunities
• Perks Paid Parking Service Awards
• Hybrid work arrangements
• Business casual environment
• A strong organizational culture focused on our greatest asset: you!

We value diverse backgrounds and adding new perspectives.

Please note, applicants must be authorized to work for any employer in the U.S. We are unable to sponsor or take over sponsorship of an employment visa.

GreatAmerica is the largest independent, family-owned national commercial equipment finance companies in the U.S. and is dedicated to helping manufactures, vendors, and dealers be more successful and keep their customers for a lifetime. With a focus on the small ticket vendor and OEM finance channel we have partnered with some of the largest and industry leading companies in the Office Equipment, Communications, IT, Automotive, Construction, Healthcare, and Franchise market sectors. In addition to financing, GreatAmerica offers innovative non-financial services to help our customers grow.

At GreatAmerica we enjoy the benefits of being independent and family-owned, fostering quick decision making, customer response and innovation. Established in 1992 our team has grown to over 650 employees and a portfolio of over $2.5+ Billion. Our exemplary customer service, principle-centered business philosophy and team-based operating approach are key to our success and growth. With a strong balance sheet and consistent financial performance through all economic cycles, GreatAmerica has experienced amazing results and unparalleled growth. When you are part of the GreatAmerica team, you will grow professionally and work with some of the most talented finance professionals in the industry. There is no doubt in our minds we are building the greatest company of its kind, offering the finest products and services available anywhere.

When you are part of the GreatAmerica team, you are part of the future, part of an opportunity to grow professionally and to reach your potential while enjoying your work.