Workforce IAM Engineer

<h3>Accountabilities</h3><li>Design, build, test, deploy, and maintain persona-based RBAC roles and access policies as applications and workforce personas are onboarded.</li><li>Develop scalable application logic, automation, integrations, and workflows across Microsoft Entra ID and Okta.</li><li>Configure and maintain application onboarding, SSO, SCIM, and identity automation using Microsoft Graph, Okta APIs, and related technologies.</li><li>Develop PowerShell and/or Python scripts and tooling to automate role assignment, provisioning, reporting, and identity workflows.</li><li>Maintain RBAC implementations as organizational structures, entitlements, applications, and access requirements evolve.</li><li>Write, test, document, and review code in accordance with engineering standards, including appropriate unit testing and version control practices.</li><li>Administer the enterprise password management platform, including vault structures, policies, group and SCIM provisioning, onboarding, offboarding, and upgrades.</li><li>Manage the lifecycle of hardware security keys, including enrollment, provisioning, replacements, PIN resets, and recovery of lost or damaged devices.</li><li>Coordinate with asset management teams on security-key distribution, reclamation, replacement, and offboarding logistics.</li><li>Monitor identity platform health, apply updates, work with vendors to resolve issues, and maintain operational readiness.</li><li>Analyze authentication, authorization, and access data to support troubleshooting, audits, and continuous improvement.</li><li>Investigate and resolve application access problems, authentication errors, and integration failures, escalating issues when appropriate.</li><li>Support end users and partner teams with identity-related requests, RBAC questions, and platform capabilities.</li><li>Participate in on-call rotations and respond to identity platform incidents according to established escalation procedures.</li><li>Contribute to runbooks, knowledge articles, and technical documentation that improve team efficiency and reduce recurring issues.</li><h2>Requirements</h2><li>3+ years of IT engineering experience, including at least 1 year administering an enterprise password management platform; experience with 1Password is preferred, while Keeper or Bitwarden experience is also relevant.</li><li>Hands-on experience with Active Directory, Microsoft Entra ID, and Okta, including application onboarding and SSO/SCIM configuration.</li><li>Strong understanding of IAM concepts such as RBAC, SSO, SAML, OIDC, MFA, authentication, authorization, and access governance.</li><li>Practical experience with hardware security tokens such as YubiKey, Google Titan, or Feitian.</li><li>Scripting experience with PowerShell, Python, or both, ideally including Microsoft Graph automation and Entra ID application registrations.</li><li>Working knowledge of ITIL or comparable change-management practices, including change requests, incident management, and release processes.</li><li>Experience with cloud platforms, with Azure required and AWS strongly preferred.</li><li>Familiarity with Git, CI/CD, code reviews, and modern software development practices.</li><li>Exposure to privileged access management platforms such as CyberArk is strongly preferred.</li><li>Strong troubleshooting, analytical, and practical decision-making abilities, with a proactive approach to identifying and resolving problems.</li><li>Strong written and verbal communication skills, with the ability to document technical decisions and create useful runbooks and knowledge articles.</li><li>Willingness and ability to learn emerging technologies and adopt new digital and AI-driven tools.</li><li>Security certifications or coursework such as CISSP, CISA, SC-300, AZ-900, Security+, or AI governance credentials are advantageous.</li><li>Ability to work independently while collaborating effectively with engineers, security teams, application owners, and other stakeholders.</li><li>Authorization to work in the United States for any employer.</li><li>Commitment to mission-driven work, continuous learning, inclusive collaboration, and delivering measurable impact.</li><h2>Benefits</h2><li>
<strong>Remote-first position</strong>within the United States, with hybrid flexibility available for employees located near designated offices.</li><li>Full-time employment with occasional travel for in-person business activities.</li><li>Hiring salary range of<strong>$128,000–$139,000</strong>, with compensation adjusted based on location, experience, qualifications, impact, and market data.</li><li>Competitive compensation designed around fairness, transparency, and market benchmarks.</li><li>Annual bonus opportunities and potential merit-based raises and promotions.</li><li>Comprehensive benefits package designed to support employee wellbeing and long-term growth.</li><li>Opportunities for professional development and continued learning in IAM, cloud security, automation, and emerging technologies.</li><li>Mission-driven work supporting expanded educational and career opportunities.</li><li>Collaborative environment with opportunities to work alongside experienced security and identity professionals.</li><li>Meaningful opportunities to contribute to Zero Trust initiatives and enterprise-scale security improvements.</li>