Identity & Access Management Engineer

Description

The company makes SonarQube, a platform that checks code for verification and governance. It is trusted by more than 7 million developers and 75% of the Fortune 100, and is used by teams at Nvidia, ServiceNow, Booking.com, Goldman Sachs, AstraZeneca and Ford Motor Company. Founded in Geneva and now headquartered in Austin, Texas, the company has a global team across offices and hubs in Silicon Valley, London, Bochum, Barcelona, Singapore, Tokyo and the Washington, D.C. area.

This is an IAM Engineer role to design, build and run the identity platforms that control access to applications, infrastructure and data. You will set the technical direction for authentication, authorization, lifecycle management and privileged access, working with security, IT, engineering and compliance teams to build a Zero Trust access experience that is secure, scalable and easy to use.

Responsibilities

• Design, build and maintain enterprise IAM systems, covering SSO, MFA, federation and directory services.
• Design the joiner, mover and leaver processes and automate provisioning and deprovisioning across SaaS, cloud and on-prem systems.
• Run Privileged Access Management, including vaulting, session management and just-in-time access.
• Drive Identity Governance and Administration work, such as access reviews, certifications, RBAC and segregation-of-duties controls.
• Connect applications to the identity platform using SAML, OIDC, OAuth 2.0, SCIM and LDAP.
• Build automation and tooling with APIs, scripts, CI/CD pipelines and Infrastructure as Code to cut manual identity work.
• Secure identity and access in AWS, Azure and/or GCP, including IAM policies, workload identity and service accounts.
• Set and enforce authentication and authorization standards, policies and best practices.
• Watch for identity threats and support detection and response to account compromise, credential abuse and privilege escalation.

Requirements

• Have 6 to 15 years of experience in IAM, security engineering or a related field.
• Have hands-on work with at least one major IAM platform, such as Okta, Microsoft Entra ID (Azure AD), Ping Identity, ForgeRock, SailPoint or CyberArk.
• Know identity protocols and standards well: SAML 2.0, OAuth 2.0, OpenID Connect, SCIM, LDAP and Kerberos.
• Have experience with Active Directory and directory services architecture.
• Be proficient in at least one of Python, PowerShell, Go, Java or JavaScript.
• Understand cloud IAM models such as AWS IAM, Azure RBAC and GCP IAM.
• Have experience with MFA, passwordless and conditional or risk-based access.
• Be familiar with Zero Trust, least privilege and defense-in-depth.
• Communicate clearly and solve analytical problems well.

Conditions

The role is based in Geneva. Candidates must be willing to work from Geneva, though the company will consider relocating the right person.

The company is committed to diversity, equity and inclusion. Accommodation requests can be sent to the company's site.

Applications from agencies or third-party recruiters will not be considered.