Senior Identity & Access Management (IAM) Engineer

Job Title: Senior Identity & Access Management (IAM) Engineer

100% Remote

2 rounds of interview Virtual.

1 Year plus contract

MUST HAVE SAILPOINT AND & BEYONDTRUST EXPERIENCE.

Senior Identity & Access Management (IAM) Engineer

Role Overview

Senior IAM Engineer to architect, secure, and operate our enterprise identity infrastructure [1, 2]. This role is a critical position focused on modernizing our hybrid identity footprint, enforcing zero-trust architecture, and securing privileged access. The ideal candidate possesses deep, hands-on engineering mastery across the Microsoft Entra ID suite, SailPoint Identity Governance, Active Directory, and BeyondTrust PAM [3, 4]. You will be responsible for eliminating identity risk, automating the Joiner-Mover-Leaver (JML) lifecycle, and providing high-confidence identity security across our healthcare and research networks [2].

Core Technical Stack

·  Identity Platforms: Microsoft Entra ID (Azure AD), Active Directory (AD) [3].

·  Identity Governance (IGA): SailPoint [3, 4].

·  Privileged Access Management (PAM): BeyondTrust [4].

·  Protocols & Standards: SAML, OIDC, OAuth 2.0, Kerberos, LDAP, KQL.

Key Responsibilities

 Microsoft Entra ID & Hybrid Identity Operations

·  Tenant & Core Identity: Maintain Entra ID tenant architecture, service accounts, directory roles, and emergency break-glass account governance.

·  Hybrid Identity & Synchronization: Manage Entra Connect and Cloud Sync topologies, resolve complex attribute authority matching issues, and monitor global synchronization health.

·  Groups & RBAC: Define enterprise security group standards, engineer dynamic assignment rules, and build scalable Role-Based Access Control (RBAC) and least-privilege authorization models.

 Authentication, Access Control & Application Identity

·  MFA & Passwordless: Design and enforce MFA policies, authentication methods, passwordless configurations (FIDO2, Temporary Access Pass/TAP), and manage exception architectures.

·  Conditional Access (CA): Architect and troubleshoot advanced, risk-based Conditional Access strategies tracking application, network, and device postures.

·  SSO & Application Integration: Own the full lifecycle of application registrations, enterprise apps, OAuth consent workflows, SAML/OIDC configurations, and token claims mapping.

 Privileged & Governance Controls (SailPoint & BeyondTrust)

·  Identity Governance (IGA): Partner to optimize automated SailPoint Joiner-Mover-Leaver (JML) lifecycle workflows, access packages, entitlement management, separation of duties (SoD), and user access reviews.

·  Privileged Access Management (PAM): Architect and configure BeyondTrust and Entra Privileged Identity Management (PIM) to enforce Just-In-Time (JIT) access, admin role approvals, and privileged session auditing.

·  External Identity (B2B): Enforce guest user lifecycle configurations, cross-tenant synchronization, external vendor access reviews, and naming standards.

 Identity Security, Compliance & Incident Response

·  Security Monitoring: Leverage Entra Identity Protection and Microsoft Sentinel integrations to proactively triage identity alerts and anomalies.

·  Compliance & Auditing: Respond to identity-centric incident escalations, gather evidence for regulatory audits, and author Standard Operating Procedures (SOPs).

Required Qualifications

·  Experience: 7+ years of dedicated Identity and Access Management (IAM) engineering experience within an enterprise environment.

·  Platform Mastery: Proven hands-on engineering experience configuring and maintaining Microsoft Entra ID (Azure AD) and on-premises Active Directory [3].

·  Governance Tools: Deep technical experience interacting with SailPoint for identity lifecycle automation and access governance [3, 4].

·  Privileged Infrastructure: Hands-on experience operating BeyondTrust or Entra PIM for privileged credential vaulting and session management [4].

·  Automation: Strong scripting capabilities (PowerShell, Microsoft Graph API) to automate administrative identity tasks.

·  Education: Bachelor’s degree in Computer Science, Information Security, or equivalent professional experience.

Preferred Certifications

·  Microsoft Certified: Identity and Access Administrator Associate (SC-300)

·  Microsoft Certified: Azure Administrator Associate (AZ-104)

·  Certified Information Systems Security Professional (CISSP)

·  SailPoint Certified IdentityNow/IdentityIQ Engineer or BeyondTrust Certified Engineer [4]