Sr Engineer, IAM

Interactive Brokers Group; Greenwich, Chicago, New York, Fort Lauderdale (CT, IL, NY, FL); On-site; USD 120,000 - 190,000; Full time

Benefits offered by this job

401(k) match

Medical, dental, vision benefits

Paid parental leave

Wellness program

Education reimbursement

Job summary

Interactive Brokers Group is seeking a Senior IAM Engineer to lead design, implementation, and operations of the company’s identity and access management program. You will architect, deploy, and support IAM across IGA, IdP/SSO, PAM, and directory services with automation, lifecycle provisioning, and scalable workflows.

You will drive integration patterns, establish target architectures, and mentor engineers while collaborating with security, IT, HR, and business stakeholders to translate

Qualifications

• Bachelor’s degree or equivalent in Computer Science, Engineering, or related field.
• Minimum 5 years of hands-on experience in IAM engineering.
• Hands-on expertise with enterprise IAM platforms across IGA, IdP/SSO (e.g., Okta, Entra ID), PAM, directory services, lifecycle management, and access governance.
• Strong understanding of IAM fundamentals, including authentication, authorization, RBAC, ABAC concepts, least privilege, separation of duties, access reviews, joiner-mover-leaver processes, identity data management, and privileged access controls.
• Experience implementing or supporting an IGA platform, preferably SailPoint Identity Security Cloud or a comparable enterprise IGA solution.
• Experience with IGA capabilities such as authoritative-source integration, account aggregation, correlation, identity profiles, attribute mappings, provisioning, access requests, approvals, certifications, access profiles, roles, entitlements, and lifecycle workflows.
• Strong knowledge of standards and protocols such as OAuth 2.0, OIDC, SAML 2.0, and SCIM.
• Experience configuring and troubleshooting SSO, provisioning, MFA, directory synchronization, conditional/adaptive access controls, and application integrations in platforms such as Microsoft Entra ID, Okta, or equivalent IdPs.
• Experience with a PAM platform, preferably CyberArk or an equivalent enterprise solution, including privileged-account lifecycle management, safe/vault administration, platform and policy configuration, credential rotation, reconciliation, and session management.
• Proven experience building REST API-driven identity integrations and lifecycle automation using Python, PowerShell, Java, or similar languages in orchestration platformes such as Okta Workflows, Gitlab, Jenkins or similar.
• Experience using APIs, scripting, and automation to manage IAM configurations, perform reporting, conduct health checks, and reduce operational overhead.
• Experience with directory services administration and governance, including Active Directory, OpenLDAP, and cloud-based IdPs.
• Solid understanding of identity data management, including attribute normalization, identity matching and correlation, duplicate identity resolution, data-quality remediation and database connectivity concepts (e.g., PostgreSQL, JDBC/ODBC).
• Demonstrated ability to manage competing priorities, deliver under pressure, and lead complex technical workstreams.
• Strong written and verbal communication skills; able to explain technical concepts to diverse audiences.

Responsibilities

• Design, build, and deliver IAM engineering solutions including IGA, IdP/SSO, PAM, and directory services implementations.
• Assess and help rationalize complex identity environments, including distributed Active Directory domains, Entra ID, LDAP/OpenLDAP deployments, application directories, and legacy identity integrations.
• Develop target-state identity architectures and integration patterns that support cohesive joiner-mover-leaver lifecycle processes, secure access, data quality, and operational scalability.
• Configure and support IGA capabilities such as identity profiles, authoritative sources, account correlation, attribute mappings, transforms, lifecycle states, sources/connectors, access profiles, roles, entitlements, access requests, approvals, certifications, and separation of duties controls.
• Design, implement, and troubleshoot lifecycle provisioning and deprovisioning workflows across HR systems, directories, SaaS applications, databases, collaboration platforms, and IT service‑management tools.
• Develop, test, and deploy identity automation, API‑driven integrations, and lifecycle provisioning workflows
• Build and maintain IAM configuration promotion and development workflows, including source control, peer review, testing, release management, and platform‑specific tooling such as SailPoint Configuration Hub, SP-Config, SDKs, or equivalent tools.
• Design and maintain RBAC models, including role discovery, role design, entitlement mapping, access‑profile design, role lifecycle management, and ongoing troubleshooting of access outcomes.
• Configure and support IdP/SSO integrations using SAML, OAuth 2.0, OpenID Connect (OIDC), SCIM, and, where needed, WS‑Federation and LDAP‑based authentication patterns.
• Engineer and support PAM capabilities, including privileged account onboarding, reconciliation, password rotation, verification, decommissioning, safe/vault access controls, approval workflows, least‑privilege access, and separation of duties.
• Integrate PAM platforms with Active Directory/LDAP, MFA, ticketing platforms, SIEM tools, cloud services, CI/CD pipelines, and identity governance solutions.
• Automate privileged‑account onboarding, reporting, health checks, credential operations, and operational tasks through PowerShell, Python, REST APIs, and related tooling
• Serve as a hands‑on senior technical resource for complex architecture decisions, design reviews, and escalated engineering issues.
• Diagnose and resolve identity‑related issues involving aggregation, provisioning, correlation, authentication, SSO, MFA, directory synchronization, access requests, certifications, privileged credential rotation, session access, and connector or platform health.
• Support SLAs, incident response, and root‑cause analysis for IAM infrastructure.
• Develop and maintain engineering runbooks, documentation standards, and disaster recovery procedures for identity systems.
• Champion automation‑first approaches to reduce manual effort across access provisioning, certification, and onboarding workflows.
• Provide technical guidance, code review, and mentorship to other engineers on the IAM team.
• Partner with security, IT, HR, and business stakeholders to gather requirements and translate them into engineering deliverables.

Skills

IAM engineering

Identity Governance

IdP/SSO

PAM

Directory services

SailPoint

OAuth/OIDC/SAML

PowerShell

Python

REST APIs

Education

Bachelor’s degree or equivalent

Tools

SailPoint Configuration Hub

SP-Config

SDKs

CyberArk

Okta

GitLab

Jenkins

Active Directory

Entra ID

Job description

About the role –

As a Senior IAM Engineer, you will be a key member of the Enterprise IT organization, serving as a senior hands‑on engineer responsible for the design, implementation, and operation of our enterprise‑wide Identity and Access Management program.

The role will be responsible for engineering and delivering IAM solutions across Identity Governance and Administration (IGA), Identity Providers (IdP/SSO), Privileged Access Management (PAM), and directory services. You will help bring together a complex, distributed identity environment, including Active Directory, Microsoft Entra ID, LDAP/OpenLDAP, SaaS applications, and enterprise platforms, into secure, scalable, automated, and supported identity workflows. The responsibilities include building automation, API‑driven integrations, and lifecycle provisioning workflows; serving as a senior technical authority for architecture decisions and escalated engineering issues; driving integration across platforms such as Dayforce, M365, and ServiceNow; providing technical mentorship to other engineers; and collaborating with security, IT, HR, and business stakeholders to translate requirements into engineering deliverables.

We are seeking a well‑rounded IAM engineer with strong identity fundamentals, broad integration experience, and the ability to apply those skills across evolving technologies. The successful candidate will have deep expertise in enterprise IAM platforms and protocols and will be comfortable assessing existing identity environments, defining target‑state architecture, designing practical integration patterns, building automation, and operationalizing solutions through documentation, monitoring, support processes, and continuous improvement.

What will you do:

• Design, build, and deliver IAM engineering solutions including IGA, IdP/SSO, PAM, and directory services implementations.
• Assess and help rationalize complex identity environments, including distributed Active Directory domains, Entra ID, LDAP/OpenLDAP deployments, application directories, and legacy identity integrations.
• Develop target-state identity architectures and integration patterns that support cohesive joiner-mover-leaver lifecycle processes, secure access, data quality, and operational scalability.
• Configure and support IGA capabilities such as identity profiles, authoritative sources, account correlation, attribute mappings, transforms, lifecycle states, sources/connectors, access profiles, roles, entitlements, access requests, approvals, certifications, and separation-of-duties controls.
• Design, implement, and troubleshoot lifecycle provisioning and deprovisioning workflows across HR systems, directories, SaaS applications, databases, collaboration platforms, and IT service‑management tools.
• Develop, test, and deploy identity automation, API‑driven integrations, and lifecycle provisioning workflows
• Build and maintain IAM configuration promotion and development workflows, including source control, peer review, testing, release management, and platform‑specific tooling such as SailPoint Configuration Hub, SP-Config, SDKs, or equivalent tools.
• Design and maintain RBAC models, including role discovery, role design, entitlement mapping, access‑profile design, role lifecycle management, and ongoing troubleshooting of access outcomes.
• Configure and support IdP/SSO integrations using SAML, OAuth 2.0, OpenID Connect (OIDC), SCIM, and, where needed, WS‑Federation and LDAP‑based authentication patterns.
• Engineer and support PAM capabilities, including privileged account onboarding, reconciliation, password rotation, verification, decommissioning, safe/vault access controls, approval workflows, least‑privilege access, and separation of duties.
• Integrate PAM platforms with Active Directory/LDAP, MFA, ticketing platforms, SIEM tools, cloud services, CI/CD pipelines, and identity governance solutions.
• Automate privileged‑account onboarding, reporting, health checks, credential operations, and operational tasks through PowerShell, Python, REST APIs, and related tooling
• Serve as a hands‑on senior technical resource for complex architecture decisions, design reviews, and escalated engineering issues.
• Diagnose and resolve identity‑related issues involving aggregation, provisioning, correlation, authentication, SSO, MFA, directory synchronization, access requests, certifications, privileged credential rotation, session access, and connector or platform health.
• Support SLAs, incident response, and root‑cause analysis for IAM infrastructure.
• Develop and maintain engineering runbooks, documentation standards, and disaster recovery procedures for identity systems.
• Champion automation‑first approaches to reduce manual effort across access provisioning, certification, and onboarding workflows.
• Provide technical guidance, code review, and mentorship to other engineers on the IAM team.
• Partner with security, IT, HR, and business stakeholders to gather requirements and translate them into engineering deliverables.

What you will need to have:

• Bachelor’s degree or equivalent in Computer Science, Engineering, or related field.
• Minimum 5 years of hands‑on experience in IAM engineering.
• Hands‑on expertise with enterprise IAM platforms across IGA, IdP/SSO (e.g., Okta, Entra ID), PAM, directory services, lifecycle management, and access governance.
• Strong understanding of IAM fundamentals, including authentication, authorization, RBAC, ABAC concepts, least privilege, separation of duties, access reviews, joiner‑mover‑leaver processes, identity data management, and privileged access controls.
• Experience implementing or supporting an IGA platform, preferably SailPoint Identity Security Cloud or a comparable enterprise IGA solution.
• Experience with IGA capabilities such as authoritative‑source integration, account aggregation, correlation, identity profiles, attribute mappings, provisioning, access requests, approvals, certifications, access profiles, roles, entitlements, and lifecycle workflows.
• Strong knowledge of standards and protocols such as OAuth 2.0, OIDC, SAML 2.0, and SCIM.
• Experience configuring and troubleshooting SSO, provisioning, MFA, directory synchronization, conditional/adaptive access controls, and application integrations in platforms such as Microsoft Entra ID, Okta, or equivalent IdPs.
• Experience with a PAM platform, preferably CyberArk or an equivalent enterprise solution, including privileged‑account lifecycle management, safe/vault administration, platform and policy configuration, credential rotation, reconciliation, and session management.
• Proven experience building REST API‑driven identity integrations and lifecycle automation using Python, PowerShell, Java, or similar languages in orchestration platformes such as Okta Workflows, Gitlab, Jenkins or similar.
• Experience using APIs, scripting, and automation to manage IAM configurations, perform reporting, conduct health checks, and reduce operational overhead.
• Experience with directory services administration and governance, including Active Directory, OpenLDAP, and cloud‑based IdPs.
• Solid understanding of identity data management, including attribute normalization, identity matching and correlation, duplicate identity resolution, data‑quality remediation and database connectivity concepts (e.g., PostgreSQL, JDBC/ODBC).
• Demonstrated ability to manage competing priorities, deliver under pressure, and lead complex technical workstreams.
• Strong written and verbal communication skills; able to explain technical concepts to diverse audiences.

What would be nice to have:

• Direct experience with SailPoint Identity Security Cloud, including tenants, identity profiles, transforms, sources, workflows, lifecycle states, access governance, APIs, Configuration Hub, SP-Config, SDKs, or related development tooling.
• Direct experience with CyberArk administration, including Digital Vault, PVWA, CPM, PSM, safes, platforms, account management, privileged sessions, and integrations.
• Direct experience with Okta administration, including Universal Directory, Lifecycle Management, group rules, application integrations, MFA, sign‑on policies, Okta Workflows, APIs, Terraform, and SCIM provisioning.
• Experience in regulated industries such as financial services, healthcare, etc.
• Familiarity with Zero Trust principles and their application to identity and access controls.
• Industry certifications such as CISSP, CISM, or vendor‑specific IAM credentials (e.g., Okta Certified Professional).

Company benefits:

• Competitive salary, annual performance‑based bonus, and stock grant awards
• 401(k) retirement plan with competitive company match
• Excellent health and wellness benefits, including medical, dental, and vision benefits. 100% employer‑paid medical premiums, with generous employer contributions to dental & vision plans as well.
• Wellness screening and assessments, health coaches, and counseling services through an Employee Assistance Program (EAP)
• Generous paid parental leave (up to 16 weeks paid parental leave for eligible employees)
• Company‑paid basic life insurance, accidental death & dismemberment (AD&D), and short- and long‑term disability coverage
• Flexible Spending Accounts (Healthcare, Dependent Care, and Commuter FSAs)
• Quarterly fitness stipend to offset costs associated with traditional gym and fitness memberships or fees
• Education reimbursement and professional development opportunities
• Legal services, telehealth access, and voluntary insurance options
• Backup child and adult care support through Care.com
• Daily lunch allowance and fully stocked kitchen with healthy breakfast and snack options