Engineer III, Identity and Access Management

Now is the time to join PDS Health. You will have opportunities to learn new skills from our team of experienced professionals. If you're ready to take your career to the next level and gain valuable experience, apply today!

The Engineer III, Cybersecurity & Risk Mgmt.

- Identity & Access Management independently owns and executes Identity

Governance & Administration (IGA) functions — including identity lifecycle management, access certifications, entitlement

governance, and SaaS security posture — with minimal supervision. Embedded within the IAM team under Cybersecurity & Risk

Mgmt., this position carries primary ownership of day‑to‑day IGA operations and tooling, applying critical thinking to resolve

complex access challenges and ensuring all deliverables meet quality and compliance standards.

Focused on protecting information assets, infrastructure, and patient data, this role enforces least‑privilege access

principles across enterprise and clinical systems through automated JML workflows, role‑based access controls, SoD policy

management, and continuous governance of SaaS application access.

Working in close coordination with IT Operations, HR, Compliance, Privacy, and Clinical Informatics, this role translates policy

into enforceable access controls, contributes to process improvement across the IAM program, and may mentor entry‑level team

members. It ensures adherence to the HIPAA Security and Privacy Rule, PCI DSS, HITRUST, ISO 27001:2022, ISO 22301:2019, and

other applicable regulatory frameworks

• Own and maintain the IGA technical roadmap, governance frameworks, and entitlement catalog, ensuring identity capabilities are consistently implemented and aligned to organizational policy.

• Manage the full identity lifecycle for all human and non‑human entities — including automated joiner, mover, and leaver (JML) workflows — ensuring secure and auditable provisioning and deprovisioning across enterprise and clinical systems.

• Design, build, and continuously optimize role‑based access control (RBAC) frameworks, including role mining, role design, and access request workflows, to enforce least‑privilege principles across all environments.

• Define, implement, and maintain Segregation of Duties (SoD) policies; perform conflict detection and lead remediation workflows in partnership with Compliance and application owners.

• Lead and execute periodic access certification and recertification campaigns, ensuring timely completion, appropriate reviewer engagement, and documented outcomes for audit purposes.

• Manage SaaS application access governance, including shadow IT discovery, OAuth grant reviews, and SaaS‑to‑SaaS integration risk remediation, using the organization's IGA and SaaS security posture toolset.

• Architect and maintain integrations between IGA platforms and authoritative sources (HR systems, directories) and downstream applications, including EHR/EMR platforms, using SCIM, REST APIs, SAML, and other standards‑based protocols.

• Author and maintain comprehensive technical documentation including architectural diagrams, workflow mappings, and SOPs for all IGA systems and processes to ensure operational consistency and audit readiness.

• Proactively identify, measure, and remediate access‑related risks; perform compliance reporting and regular access control audits to protect critical assets, including PHI and PII.

• Lead organizational efforts to ensure IGA controls and processes align with HIPAA Security and Privacy Rule, HITRUST, PCI DSS, ISO 27001:2022, and other applicable regulatory frameworks.

• Ensure the confidentiality, integrity, and availability (CIA) of identity services in accordance with defined SLA metrics, maintaining high levels of data security and patient satisfaction.

• Serve as a technical liaison between Information Technology and business units, proactively identifying access governance gaps and architecting solutions that balance security with operational efficiency.

• Collaborate with leaders, architects, and stakeholders to translate business and compliance requirements into IGA controls, building trust‑based relationships that position security as an enabler.

• Research emerging IGA…