Senior Infrastructure Security Engineer - Identity and Access Management (IAM)

Description

The company's Global Technology team builds secure, scalable identity capabilities and places digital transformation, risk management and engineering quality at the center of its work.

The role is a senior IAM engineering position focused on enterprise identity across Microsoft Entra ID, Active Directory and identity governance platforms, working with product owners, application teams, architects, security, risk and operations to modernize authentication, automate identity lifecycles and tighten access governance.

The work covers hands-on engineering and troubleshooting, with clear documentation from requirements and design through testing, cutover and production support.

Responsibilities

• Build and support IAM services across Microsoft Entra ID, Active Directory and enterprise identity platforms, with a focus on security, availability and operational readiness.
• Onboard applications for SSO and provisioning using SAML 2.0, OpenID Connect, OAuth 2.0 and SCIM, covering metadata, certificates, redirect URIs, claims, attributes and provisioning rules.
• Design and maintain RBAC, permission sets, group-based entitlements and segregation-of-duties controls that enforce least privilege.
• Run joiner, mover and leaver processes, including provisioning, de-provisioning, approvals, access reviews, expiry and exception handling.
• Build and enforce Microsoft Entra Conditional Access, MFA, passwordless authentication and Privileged Identity Management controls.
• Plan and carry out tenant-to-tenant and hybrid identity changes, covering application discovery, identity mapping, domain and UPN questions, cross-tenant synchronization, cutover and validation.
• Troubleshoot complex authentication, authorization, token, federation, directory sync, Kerberos, SSO and provisioning issues at L2 and L3.
• Automate operational and compliance tasks with PowerShell, Microsoft Graph and platform APIs, using proper testing, logging and change control.
• Work with application owners, architects, risk, audit and global engineering teams to turn requirements into secure, supportable solutions.
• Write and maintain engineering specifications, architecture diagrams, runbooks, support procedures, test evidence and audit-ready control documentation.
• Take part in Agile delivery, including backlog refinement, estimation, testing, release planning and post-implementation support, and mentor other engineers.

Requirements

• Bachelor's degree in computer science, information systems, cybersecurity or a related field, or equivalent practical experience.
• 5+ years of IAM, identity security or access management engineering experience. 7+ years of general IT or cybersecurity experience is preferred.
• Hands-on work with Microsoft Entra ID and Active Directory in enterprise or hybrid environments.
• Proven experience connecting applications for SSO and automated provisioning using SAML, OIDC, OAuth and SCIM.
• Working knowledge of RBAC, access certifications, segregation of duties, lifecycle management and audit evidence.
• Experience with at least one enterprise IAM platform, such as Silverfort, BloodHound, Veza or Microsoft Defender.
• Strong understanding of Conditional Access, MFA, passwordless authentication, PIM/PAM, identity protection and least privilege.
• Experience diagnosing identity flows across cloud apps, on-premises directories, federation services and provisioning connectors.
• PowerShell scripting experience. Familiarity with Microsoft Graph, REST APIs, JSON, XML and SQL.
• Ability to assess complex technical problems, spot risk, recommend practical fixes and see issues through to resolution.
• Clear written and spoken communication, able to work with technical teams, control partners and business stakeholders.
• Experience in Agile or Scrum teams and with Jira or similar planning tools.
• Core technical areas include Entra ID, Active Directory, CyberArk, Veza, SAML 2.0, OIDC, OAuth 2.0, SCIM, SSO, federation, MFA, FIDO2, Windows Hello for Business, RBAC, PIM, PAM, LDAP, Entra Connect, cross-tenant sync, guest B2B and B2C, app registrations, enterprise applications, PowerShell, Microsoft Graph, REST APIs, JSON, XML, SQL, Azure, AWS IAM concepts, ServiceNow, SAP and other SaaS or on-premises apps, Agile/Scrum, Jira, incident, problem and change management, monitoring, audit support and production readiness.
• Preferred: experience in regulated environments answering SOX, PCI, internal audit or similar control requirements.
• Preferred: experience with identity tenant migrations, domain or forest consolidation, cross-tenant synchronization and global cutover coordination.
• Preferred: experience rolling out passwordless authentication and reducing standing privileged access through PIM or PAM.
• Preferred: familiarity with Azure Monitor, Log Analytics, Splunk or comparable monitoring and security analytics tools.
• Preferred: relevant certifications such as Microsoft Certified: Identity and Access Administrator Associate (SC-300), Microsoft cybersecurity credentials, or SailPoint, Okta or CyberArk certifications.
• Preferred: experience working across regions and time zones, including occasional support for planned production changes outside core business hours.

Conditions

Success means delivering secure, supportable identity services, cutting manual access work, improving authentication reliability and producing clear evidence that controls work as designed.

Prudential may use identity verification during hiring, with your consent obtained first.

Accommodation requests for the application process are handled by the company's hiring team.

Benefits

• The salary range is $104,000.00 to $171,600.00, and the actual pay may vary within that range based on location, candidate experience and skills. This range is included because of state-specific pay transparency laws for applicable locations.
• Competitive base salary with yearly bonus potential at every level.
• Discretionary annual incentive, subject to program rules, with awards depending on individual and organizational performance.
• Medical, dental, vision, life and disability insurance, PTO and leave of absence, including parental and military leave.
• 401(k) with company match of up to 4%.
• Company-funded pension plan.
• Wellness reimbursement of up to $1,600 a year for personal wellbeing items.
• Work/life resources covering parenting, housing, senior care, finances, pets, legal matters, education, emotional and mental health and career development.
• Education benefit to help fund traditional college enrollment toward an approved degree and many accredited certificate programs.
• Employee stock purchase plan allowing shares to be bought at 85% of the lower of the two prices at the start or end of the purchase period.
• Some benefits may not apply to part-time employees scheduled for fewer than 20 hours per week.
• The company is not affiliated with Prudential plc, which is headquartered in the United Kingdom.