Lead IAM Engineer

This is a fully remote position, open to applicants in Pennsylvania.

📋 Description

• Take ownership of the strategy, operations, and roadmap for enterprise Identity and Access Management (IAM).

• Act as the lead for the North American IAM Center of Excellence and collaborate with global COE counterparts.

• Oversee IAM integration efforts for mergers, acquisitions, and divestitures.

• Direct the design, implementation, and operation of Single Sign-On (SSO), Multi-Factor Authentication (MFA), Privileged Access Management (PAM), Identity Governance and Administration (IGA), and directory services.

• Lead product assessments, tool consolidations, and IAM initiatives supported by data-driven financial business cases.

• Implement IAM policies and standards while developing procedures that align with NIST, CIS, ISO 27001, SOX, and other frameworks.

• Manage joiner/mover/leaver execution, access provisioning, role engineering, and automated de-provisioning.

• Promote automation and self-service functionalities for access requests, approvals, provisioning, and entitlement reviews.

• Collaborate with End User Services and the Service Desk to automate ticket-based access requests.

• Enhance PAM adoption, focusing on vault adoption, session monitoring, and just-in-time access.

• Partner with Cyber and Network Operations to implement Zero Trust, manage SSO group management, identity-centric network access controls, and conditional access policies.

• Develop and maintain integrations among IAM platforms, HR systems, ticketing systems, and downstream applications.

• Establish KPIs and metrics for access hygiene, orphaned accounts, privilege sprawl, and SLA performance; provide quarterly reports on program health.

• Oversee IAM vendor relationships, licensing, and contract renewals in collaboration with Cyber and Procurement.

• Mentor IAM engineers and analysts.

• Assist in SOX, SOC 2, and ISO 27001 audits by providing evidence, control narratives, and tracking remediation efforts.

• Lead IAM roadmap planning for a 12–18 month timeframe.

⛳️ Requirements

• A Bachelor's degree in Information Technology, Computer Science, Cybersecurity, or a related field; equivalent professional experience may be accepted in lieu of a degree.

• At least 8 years of progressive experience in information security or information technology, with a minimum of 4 years specifically focused on IAM.

• More than 3 years of experience serving as a senior or lead technical contributor in an IAM function or program within a mid-to-large enterprise environment (5,000+ employees).

• Practical engineering experience in designing, building, and operating enterprise IAM automation, including workflow engines, API/SCIM-based provisioning pipelines, and self-service access solutions.

• Experience in integrating Joiner-Mover-Leaver (JML) automation with an HRIS platform such as Workday or SAP SuccessFactors.

• Proven experience in automating access certification/recertification campaigns at an enterprise scale.

• Familiarity with supporting SOX, SOC 2, ISO 27001, HIPAA, or equivalent audits.

• Experience in managing PAM programs and vault platforms like CyberArk, BeyondTrust, or Delinea in a production environment.

• Demonstrated ability to create data-driven business cases that yield measurable cost savings and licensing efficiencies.

• Strong engineering mindset with the capability to design, script, and deploy automated identity workflows using SCIM, LDAP, and REST/API connectors.

• Proficient in building automated provisioning, de-provisioning, and entitlement review pipelines across SaaS, cloud, and on-premises systems.

• Scripting and automation experience with PowerShell, Python, or workflow orchestration platforms.

• Extensive knowledge of SAML 2.0, OAuth 2.0, OIDC, Kerberos, and LDAP/LDAPS.

• Strong comprehension of Zero Trust architecture, conditional access, and least-privilege enforcement.

• Capability to secure IAM/PAM environments against credential theft, privilege escalation, and lateral movement.

• Ability to define and monitor security KPIs.

• Skillful in designing scalable and resilient automated processes.

• Competence in building dashboards and metrics for program health and operational throughput.

• Proficient in constructing and presenting financial business cases for tooling consolidation and license optimization.

• Strong acumen in vendor and contract management.

• Relevant industry certifications preferred, including CISSP, CIAM, SC-300, or Okta Certified Professional.

• Willingness to travel as necessary to remote locations.

• Availability for on-call and extended work hours, which may include nights and weekends.

🏝️ Benefits

• 401k savings with company matching.

• Paid time off.

• Paid holidays.

• Maternity leave.

• Parental leave.

• Military leave.

• Other types of leave of absence.

• Health, dental, and vision benefits.

• Health savings accounts.

• Flexible spending accounts.

• Life and disability benefits.

• Identity theft protection.

• Pet insurance.

• Certain positions may qualify for a short-term incentive plan.