Sr. IAM Cybersecurity Engineer, Enterprise Identity

Description

The company is a Fortune 500 business that builds an AI platform for managing people, money, and agents.

The Enterprise Identity team sits in the Cyber Security function within Enterprise Security. It runs identity and access management, lifecycle management, governance and administration, and privileged access management for the whole organization.

The team works with Business Technology, Product & Technology, Legal & Compliance, Internal Audit, and other security groups to design business processes, align tooling, and document procedures.

This year the team is focused on Identity Governance and Zero Standing Privileges initiatives.

Responsibilities

• Lead the technical strategy and execution of User Access Review (UAR) programs, running certification campaigns end to end and removing access creep.
• Design and run enterprise-wide UAR programs across cloud and on-prem environments to find and fix access creep.
• Automate certification workflows and review schedules in IGA platforms to reduce admin effort and improve accuracy.
• Work with internal and external auditors to map UARs to SOX, SOC2, and ISO 27001, and produce audit-ready reporting.
• Combine Zero Standing Privileges and Just-In-Time provisioning with periodic reviews to revoke access faster and enforce least privilege.
• Apply AI and ML to risk-based reviews, revocation suggestions, and anomaly detection.
• Build identity and security services using AI and ML to detect threats and make risk-based access decisions.
• Partner with product owners on secure requirements, security architecture, and contextual authorization.
• Update security policies and procedures toward modern least-privilege identity approaches.
• Own identity security and governance across departments, influencing stakeholders at every level.
• Treat identity solutions as internal products and scale them for efficiency and adoption.
• Balance strong security controls with business agility and a smooth user experience.
• Lead three UAR areas: strategy and governance (certification cycles matched to system criticality and risk, clear entitlement ownership, definition catalogs, automated revocation); automation and intelligence (IGA platforms and AI/ML to reduce reviewer fatigue through peer-group analysis, usage signals, and automatic revocation of inactive entitlements); compliance and audit readiness (standardized audit trails, evidence collection, and SOX, SOC2, ISO 27001 reporting with full traceability of every review decision and access change).

Requirements

• Basic qualification: a bachelor's degree or higher in Computer Science, Cybersecurity, Information Security, or a related field.
• Basic qualification: 7+ years of IT or infosec experience, or 4+ years if you hold an MS.
• Basic qualification: hands-on experience designing, launching, and managing enterprise-scale UAR and access certification campaigns.
• Basic qualification: experience with Okta, including IAM and Workflows.
• Basic qualification: deep expertise in IGA tools such as Okta Identity Governance, SailPoint, or Saviynt for automated UAR campaigns, entitlement cataloging, and remediation.
• Basic qualification: familiarity with identity lifecycle management, including source of truth.
• Basic qualification: practical experience with regulatory compliance, audit readiness, and identity gap remediation.
• Other qualification: experience orchestrating complex certifications across varied systems, mapping entitlements, and enforcing regulatory controls.
• Other qualification: a product mindset focused on user experience, less friction, and measurable adoption alongside security.
• Other qualification: sound risk judgment in unclear situations, balancing security with operational needs.
• Other qualification: clear communication from engineers to the C-suite, translating identity risk into business impact.
• Other qualification: experience building secure systems and applying AI/ML to risk scoring and access control.
• Other qualification: experience assessing and reducing weaknesses in identity infrastructure and keeping up with current threats.
• Other qualification: working knowledge of Zero Trust, identity management principles, and MFA, SSO, SAML, OIDC, and LDAP.
• Nice to have: CISSP or equivalent.

Conditions

Annual base pay ranges: $159,600 USD to $239,400 USD at the primary location, USA.VA.Reston, and $144,400 USD to $258,000 USD at additional US locations.

Pay varies by work location and depends on geography, experience, skills, job duties, business need, and other factors. Recruiters can share more during hiring.

The role may be eligible for the company bonus plan or a role-specific commission or bonus, as well as annual refresh stock grants.

The company does not set a fixed number of office days. Instead, you spend at least half (50%) of your time each quarter in the office or in the field with customers, prospects, and partners, depending on role, and you set a flexible schedule around your work and personal needs. Home office roles can also join the offices for key moments.

The company considers qualified applicants with arrest and conviction records, in line with applicable Fair Chance law.

The company is an equal opportunity employer, including individuals with disabilities and protected veterans.

Benefits

• The company offers comprehensive benefits.
• Eligibility for a bonus plan or commission or bonus, plus annual refresh stock grants.