Senior IAM Engineer

Job Summary

We are seeking a Senior Identity & Access Management (IAM) Engineer to lead the design, architecture, and evolution of our enterprise IAM ecosystem across our hybrid Google Workspace and Microsoft 365 environment. In this role, you will serve as the technical authority on identity and access management, driving strategic initiatives in zero trust architecture, identity governance, and access automation.

As a senior engineer, you will not only administer and optimize our Okta platform but also architect the broader identity strategy — integrating on-prem Active Directory, Entra ID (Azure AD), Google Workspace, and SaaS applications into a cohesive, secure, and scalable identity framework. You must have hands-on experience building real integrations and making protocol decisions based on application capabilities — not just theoretical knowledge. You will mentor junior engineers, partner with security and infrastructure teams, and lead complex IAM projects from concept to delivery.

You will be the subject matter expert who ensures that the right individuals have the right access to the right resources at the right times — for the right reasons — while advancing our zero trust maturity and identity governance posture.

Key Responsibilities

Identity Architecture & Strategy

• Architect and evolve the enterprise IAM strategy across Okta, Active Directory, Entra ID (Azure AD), Google Workspace, and SaaS applications.
• Design end-to-end identity solutions for hybrid and multi-cloud environments, ensuring scalability, security, and resilience.
• Lead the evaluation, selection, and implementation of IAM tools and platforms beyond Okta (e.g., PAM solutions, IGA tools, CIEM for cloud).
• Define IAM standards, patterns, and reference architectures for the organization; document and socialize them across engineering teams.
• Drive the identity roadmap in alignment with business priorities, security initiatives, and compliance requirements.

Okta Platform Leadership

• Serve as the senior administrator and architect for the Okta Identity Cloud, including Universal Directory, Single Sign-On (SSO), Multi-Factor Authentication (MFA), Adaptive Authentication, and API Access Management.
• Design and implement complex Okta Workflows, Okta Lifecycle Management, and Okta Identity Governance (access certifications, access requests).
• Architect Okta application integrations (SAML 2.0, OIDC/OAuth 2.0, SCIM) for SaaS, on-prem, and custom applications at scale — selecting the right protocol per integration based on the app's capabilities and use case.
• Manage Okta groups, policies, rules, and application assignments with precision, documentation, and governance.
• Lead Okta platform upgrades, feature enablement, and configuration optimization.

Identity Lifecycle & Governance

• Design and implement automated joiner, mover, and leaver (JML) processes using Okta Lifecycle Management and HR system integrations (e.g., Workday, BambooHR).
• Architect user provisioning and deprovisioning workflows across cloud and on-premises applications, ensuring speed, accuracy, and security.
• Ensure accurate synchronization between identity sources (Active Directory, Entra ID, HR systems) and downstream applications, including Okta-to-Entra ID provisioning via SCIM or WS-Federation.
• Implement and manage identity governance: access reviews, certifications, segregation of duties (SoD), and privileged access governance.
• Define and enforce role-based access control (RBAC) and attribute-based access control (ABAC) models across the organization.

Zero Trust & Security

• Lead zero trust architecture initiatives by designing and enforcing least-privilege access, continuous verification, and context-aware access policies.
• Configure and manage Okta Device Trust, Okta FastPass, and passwordless authentication scenarios.
• Define and enforce adaptive MFA policies based on risk signals, context, and device posture.
• Design and implement Privileged Access Management (PAM) strategies for admin and service accounts across cloud and on-prem environments.
• Partner with the Security Operations team to monitor, detect, and respond to identity-related threats, anomalies, and access violations.
• Conduct regular IAM security assessments and penetration testing of identity infrastructure.

Integrations & Automation

• Leverage the Okta API, Terraform, and other IaC tools to automate IAM configurations, deployments, and drift detection.
• Build complex Okta Workflows to automate identity processes without code where possible; develop custom integrations where needed.
• Design CI/CD pipelines for IAM configuration deployment (Okta Terraform provider, API-based automation).
• Integrate IAM with cloud security posture management (CSPM), SIEM/SOAR, and ITSM platforms (ServiceNow) for unified security operations.
• Automate access reporting and compliance evidence collection.

Governance, Compliance & Auditing

• Ensure IAM controls and processes align with compliance frameworks (SOC 2, ISO 27001, NIST CSF, HIPAA, PCI-DSS).
• Lead IAM-related audit activities: provide evidence, documentation, and walk-throughs to internal and external auditors.
• Define and maintain IAM policies, standards, and procedures; ensure they are documented and up to date.
• Implement continuous compliance monitoring for identity controls (e.g., dormant accounts, excessive privileges, MFA enrollment gaps).
• Drive quarterly access reviews and certification campaigns across the organization.

Leadership & Collaboration

• Mentor and guide junior IAM engineers; provide technical leadership, code review, and knowledge transfer.
• Partner with IT Infrastructure, Security Operations, Cloud Engineering, and Application teams to ensure IAM solutions meet business and security requirements.
• Lead cross-functional IAM projects from concept to delivery, including project planning, stakeholder communication, and risk management.
• Present IAM strategy, risks, and recommendations to leadership and non-technical stakeholders.
• Stay current with IAM industry trends, emerging threats, and new Okta/identity platform features; evaluate and recommend adoption.

Required Qualifications

• 6+ years of hands-on experience in identity and access management, with at least 3+ years administering and engineering Okta in a production enterprise environment.
• Deep expertise in identity protocols: SAML 2.0, OAuth 2.0, OpenID Connect, SCIM, WS-Federation, LDAP, and Kerberos.
• Demonstrated hands-on experience building Okta application integrations (SAML 2.0, OIDC/OAuth 2.0, SCIM) — able to explain protocol choices based on real integrations, not just textbook definitions.
• Experience integrating Okta with Active Directory, Entra ID (Azure AD), Google Workspace, and cloud directories in a hybrid environment.