Principal IAM Engineer

Description

The company runs a specialty care platform that connects patients with top specialists for surgery, cancer care, infusions and other treatment, and pairs them with a dedicated care team including care advocates and nurses. It serves more than 6 million members for some of the largest employers in the country.

The company works in a regulated healthcare setting under HIPAA, HITRUST and SOC 2, handles protected health information at scale, and is moving toward AI, which is a top priority.

This is a senior individual-contributor role and the technical authority for identity. Because identity is effectively the security perimeter, you will own the identity control plane end to end and decide who can reach PHI and under what conditions. You will set the identity standard, build the automation behind it, and set the verification bar other teams work to.

You will report to the CISO and work closely with the IAM engineer and with the platform, cloud and service delivery teams. This is a hands-on principal role with no people management today, and it can grow into a leadership role as the identity function expands.

The security approach is open by default and secure by design. Guardrails live in the platform, pipelines and tooling, so the usual answer is yes, safely. Gates exist only where risk clearly calls for them, and they are automated, quick and transparent.

Responsibilities

• Own the identity lifecycle for joiners, movers and leavers, with provisioning and deprovisioning automated from RBAC and ABAC models. Confirm each deprovisioning against an entitlement inventory instead of assuming it worked.
• Own access management under a Zero Trust model: Conditional Access, phishing-resistant MFA and privileged access. Default to least privilege, use just-in-time elevation, and check enforcement on every access path, not just the one you expected.
• Own directory and federation across Entra ID, single sign-on, SAML, OIDC and OAuth2.
• Own secrets and non-human identities, including API keys, service accounts and workload identity, and keep an owner registry for them.
• Own key access governance and separation of duties, where another team runs the key management system.
• Own identity automation as code. Build lifecycle and access controls as reviewable, version-controlled Terraform and policy-as-code, not as manual configuration.
• Own the identity verification standard the service desk follows for password resets, MFA resets and device enrollment. Helpdesk-initiated resets are a common route to account takeover, so this is a hands-on control point.
• Deliver in your first year: Conditional Access enforced by default on PHI-facing applications, with enforcement verified.
• Deliver in your first year: automated joiner, mover and leaver provisioning and deprovisioning that meets its SLA every time.
• Deliver in your first year: a secrets golden path with vaulted secrets, no secrets in code, and a fully populated key-to-owner registry.
• Deliver in your first year: strong, phishing-resistant MFA on privileged accounts.
• Deliver in your first year: documented runbooks and enough depth across the control plane that no critical control depends on one person.
• Set standards that partner teams carry out. Service Delivery handles provisioning and resets against your verification bar. Cloud Engineering handles cloud access, workload identity and key management operations, with key access governed by you. HR events are the only trigger for lifecycle changes.
• Keep access certification outside this role. The Governance, Risk & Compliance team independently attests to the entitlements you produce, so the team reviewing access is never the team granting it.

Requirements

• Eight or more years in identity and access management, including principal or staff-level ownership of an identity control plane.
• Deep Microsoft Entra ID engineering: Conditional Access policy design, phishing-resistant MFA, single sign-on, and federation across SAML, OIDC and OAuth2. Verify that enforcement applies on every access path.
• Identity lifecycle automation across cloud, SaaS and privileged systems, with RBAC and ABAC provisioning and deprovisioning checked against an entitlement inventory.
• Zero Trust identity design, covering least privilege, just-in-time access, and risk-based or adaptive access controls.
• Engineering experience with identity governance and administration (IGA) platforms, including privileged access management.
• Scripting and automation in PowerShell, Python or similar, to build lifecycle workflows and custom connectors.
• Identity-as-code and policy-as-code practice with Terraform, under source-controlled change management such as GitHub.
• Experience managing secrets and non-human identities (API keys, service accounts, workload identity) and keeping an owner registry for them.
• Key access governance and separation of duties where another team operates the key management system.
• Ability to act as technical authority for a function without formal people-management authority, working directly to a CISO.
• A bachelor's degree in a relevant field, or equivalent professional experience.
• Strong candidates will have: experience in healthcare or another regulated environment where identity controls gate access to PHI.
• Strong candidates will have: hands-on work with Saviynt, PAM, Azure PIM and Keeper, or transferable depth in comparable platforms.
• Strong candidates will have: experience fixing a Conditional Access enforcement gap or a deprovisioning failure, and making the structural change that stopped it recurring.
• Strong candidates will have: passkeys, FIDO2 or other phishing-resistant authenticator experience, aligned with NIST SP 800-63 Rev. 4.
• Strong candidates will have: experience growing a technical scope into a wider leadership remit.
• Strong candidates will have: Microsoft Identity and Access Administrator certification, CIMP, or an equivalent credential.
• Traits that suit this role: you confirm a control works on every path before calling it done; you remove manual steps instead of documenting them; you fix the class of a failure, not just one instance; you hold partner teams to the standard without doing their work; you keep access certification independent; you use logic, stay focused through a fast pace, and celebrate wins of all sizes; you value inclusion and diverse perspectives; you bring grit and ambition to hard problems; you put customers and humanity first; you tell the truth even when it is unwelcome; and you work well in a team.

Conditions

This is a senior, hands-on individual-contributor role reporting to the CISO, with no people management today and a possible path into leadership.

The company is a regulated healthcare business, so you will work within HIPAA, HITRUST and SOC 2 requirements.

The company does not discriminate on the basis of race, sex, color, religion, age, national origin, marital status, disability, veteran status, genetic information, sexual orientation, gender identity, or any other characteristic protected by law.

Benefits

• Medical, dental and vision insurance.
• Short- and long-term disability cover and life insurance.
• 401k with company match.
• Flexible time off.
• Paid parental leave.