IAM Engineer - Cloud Platform

Design and operate federation and the entitlement model across accounts

Automate access lifecycle: joiner, mover, leaver

Build workload identity patterns; eliminate long-lived keys and standing access

Build access recertification and produce audit evidence

Onboard applications to SSO and review access designs with application teams

Integrate cloud entitlements with the enterprise identity governance platform.

Build access recertification for cloud entitlements and produce evidence for audit.

Design workload and machine identity patterns, including roles for services and OIDC for pipelines.

6+ years related work experience in IAM, security, or platform engineering, with 3+ years focused on cloud identity

Related Bachelor's degree required

Strong AWS/Azure IAM skills, including cross-account access, federation, and permission boundaries.

Hands-on experience with SSO and federation platforms.

Experience integrating an enterprise identity provider such as Okta, Entra ID, or Ping with cloud.

Hands-on Terraform.

Working knowledge of SAML, OIDC, and SCIM.

Experience in an environment governed by HIPAA, HITRUST, SOC 2, FedRAMP, or NIST 800-53.

Required to obtain Certified Information Systems Security Professional License (CISSP) within 180 Days of hire

Identity engineering across a mix of GovCloud and commercial, including the cross-partition trust boundary.

Which partition was primary does not matter. Healthcare payer experience.

Privileged access management tooling such as CyberArk.

Identity governance and administration tooling such as SailPoint or Saviynt, and lifecycle automation.

Machine identity at scale, including workload federation and secrets management.

Python or equivalent scripting for identity automation.

Cloud Security Specialty, CCSP, or an identity-focused certification.

Exerting up to 10 pounds of force occasionally to move objects.

Jobs are sedentary if traversing activities are required only occasionally.

This position offers a hybrid work arrangement which combines flexibility with in office engagement. Team schedules are determined based on role requirements and business needs. Travel to and from our corporate offices may be required.