Identity Operation Engineer

Ekman Associates is a management consulting firm that specializes in developing business, digital, and technology strategy, delivering solutions, and addressing human resource demands.

The Identity Operations Engineer operates and continuously improves hybrid identity, access, authentication, privileged-access, and identity-governance services. The role provides specialist operational support across Workday-driven identity lifecycle processes, Saviynt/IGA, Active Directory, Microsoft Entra , Microsoft 365, MFA, PAM, enterprise application integrations, and connected services.
The position will be a team player working to maintain reliable identity integrations and resolve operational issues involving joiners, movers, leavers, contractors, application access, entitlements, authentication, privileged accounts, and non-human identities. This role includes incident, request, change, problem, access-review, audit-evidence, monitoring, and automation activities. Effective communication skills are a must, all while being sensitive to a wide diversity of cultural and technical backgrounds in a global business environment.

• Apply least-privilege, segregation-of-duties, secure administration, and identity-governance best practices to protect information resources from unauthorized use, inappropriate access, disclosure, damage, or loss.
• Troubleshoot and resolve issues related to identities, systems, access, accounts, authentication, authorization, entitlements, and permissions.
• Investigate and resolve specialist escalations from AD Services and Tech Ops IAM queues, including application-role access, Sec Admin access, reference-user comparisons, disabled application accounts, access removals, and entitlement issues.
• Provide ITIL-based operational support across identity services, including incident, request, change, problem, and major-incident participation. Maintain clear Service Now assignment, evidence, troubleshooting notes, resolution details, and closure criteria.
• Operate and troubleshoot identity lifecycle integrations, including joiner, mover, leaver, contractor, rehire/rejoiner, and exception scenarios. Investigate failed provisioning tasks, reconciliation issues, orphaned accounts, and mismatches between authoritative HR data, IGA records, directories, and target applications.
• Support Workday-driven lifecycle processes and Saviynt/IGA workflows, including access requests, approvals, entitlement ownership, access reviews, remediation, audit evidence, and provisioning/reconciliation failures.
• Operate and support on-premises and cloud identity services and their configuration, including Active Directory domain services, Microsoft Entra , Microsoft 365, Duo, Yubi Key/FIDO/PIV authentication, Cyber Ark/PAM, Saviynt/IGA, Splunk, Active Roles where applicable, Ping One/Aura where applicable, 1
  
  Password, Hashi Corp Vault, and connected enterprise applications.
• Troubleshoot Microsoft Entra enterprise applications and federation integrations, including SAML, OIDC/OAuth, claims, redirect URIs, app registrations, group assignments, Conditional Access, Microsoft Graph, certificates, and token/authentication failures.
• Support privileged and non-human identities, including elevated accounts, service accounts, application accounts, RPA accounts, resource/test accounts, B2B/guest identities, and accounts requiring vault onboarding, password rotation, or ownership validation.
• Support MFA and authentication operations, including Duo, Yubi Key, FIDO/PIV, recovery/reset workflows, OAuth-token issues, and authentication failures across workforce and application services.
• Complete the key metric reporting and…