Lead Identity & Access Management Engineer

Title: Lead Identity & Access Management Engineer

Executive Area: Information Technologies

College/School/MBU: Information Technology

Department: IT Information Security

Work Location: Amherst

Schedule: Full Time

Work Arrangement:Hybrid

The Lead Identity and Access Management (IAM) Engineer contributes technical leadership for the university's enterprise-wide identity and access management program. This position is responsible for leading the design, implementation, integration, and continuous improvement of authentication, authorization, identity provisioning, and identity governance and administration (IGA) solutions across all university systems, audience types, and applications.

This role combines hands-on technical expertise and cross-functional collaboration. The Lead IAM Engineer helps drive the technical vision and roadmap for IAM services, ensures alignment with institutional security and compliance requirements, and provides guidance to a team of IAM professionals. This position continually manages the risk associated with UMass Amherst's identity and access management posture, collaborating with appropriate stakeholders to implement system-wide improvements that safeguard institutional assets while optimizing usability and value of identity services for the entire university community.

This position requires deep expertise in IAM concepts and workflows, IGA platforms, authentication and authorization applications and protocols, and the ability to manage enterprise services in a complex higher education environment.

Lead IAM initiatives:

Provide technical leadership and help inform strategic direction for the university's IAM ecosystem, including authentication services, access controls, identity governance, and related middleware that enable secure access to university systems, data, and services.

Collaborate on the architectural design, development, and documentation of both legacy and new information systems that support IAM services across on-premises and cloud environments.

Configure and maintain the Identity Governance and Administration platform(s), including identity lifecycle design and management, automated provisioning and deprovisioning, access requests and approvals, rectifications and entitlement management.

Design and implement enterprise IAM service architecture including Single Sign-On (SSO), Multi-Factor Authentication (MFA), identity federation, and automated provisioning workflows.

Analyze complex technical problems and develop innovative solutions, exercising a high level of originality, ingenuity, and application expertise.

Research and evaluate available solutions, recommend adoption strategies, and lead integration efforts within existing computing environments.

Install, configure, and maintain operating system components, applications and application servers, and integrations that support IAM infrastructure.

Collaborate with system owners, administrators, and stakeholders to implement appropriate IAM standards and best practices across all university systems.

Manage and optimize user provisioning and de-provisioning processes across the identity lifecycle.

Ensure periodic access reviews and access certifications are performed, documented, and remediated.

Proactively apply appropriate levels of IAM related auditing and monitoring across university systems.

Collaborate with IT security team, system administrators, stakeholders, and external partners and vendors to integrate identity and access management solutions.

Regularly review, evaluate, and update access policies based on changing organizational needs and compliance requirements.

Communicate effectively with customers and stakeholders to elicit requirements, present solutions, and investigate and resolve issues.

Compliance, Security, and

Risk Management:

Ensure that IAM systems remain in documented compliance with relevant frameworks, regulations, and agreements (e.g., NIST, FERPA, HIPAA, PCI-DSS, CMMC).

Research, recommend, and promote IT security policies and guidelines focused on protecting the confidentiality, integrity, and availability of university accounts, data, and computer assets both local and in the cloud.

Monitor and audit access controls to prevent unauthorized access and detect anomalous activity.

Participate in incident response and security incident investigations related to access control breaches.

Stay informed about industry trends and emerging technologies related to identity and access…