Senior Identity & Access Management Engineer

Design, implement, and continuously enhance identity governance, access management, and privileged access capabilities.
Build and maintain automated identity lifecycle workflows, certification campaigns, and connectors within SailPoint Identity Now.
Develop integrations with enterprise applications including Service Now and ILS.
Design, build, and roll out RBAC models, including role mining, role engineering, and role lifecycle governance.
Integrate and administer Okta, including SSO, MFA, and SCIM provisioning.
Implement and support Cyber Ark PAM, including credential vaulting, session isolation and monitoring, JIT elevation policies, and privileged account onboarding.
Support migration from self-hosted Cyber Ark PAS to Cyber Ark Privilege Cloud.
Develop self-service and automated access request workflows.
Automate joiner, mover, and leaver provisioning and deprovisioning across enterprise systems.
Execute access certification campaigns and quarterly configuration reviews, producing audit-ready evidence for ICFR logical access controls.
Support SOX-related access controls, segregation of duties enforcement, and ICFR audit evidence generation.
Develop Power Shell and REST API automation for entitlement extracts, reconciliation, reporting, and audit evidence.
Apply FFIEC IT examination handbook guidance to identity governance, access control design, and third-party access risk.
Partner with security, audit, compliance, infrastructure, and application teams to translate control requirements into technical solutions.
Troubleshoot, tune, and document IAM integrations and workflows for reliability, performance, and auditability.

• 5+ years of hands-on experience in Identity and Access Management engineering or administration roles.
• 3+ years of direct, hands-on experience with SailPoint (Identity IQ and/or Identity Now), including lifecycle workflows, certification campaigns, and connector development or integration.
• Demonstrated experience designing and deploying RBAC models, including role mining, role engineering, and role lifecycle governance.
• Working experience with Cyber Ark PAM, including vaulting, session isolation and monitoring, and privileged account onboarding.
• Strong Power Shell scripting and REST API experience for automation, entitlement extracts, reconciliation, and audit evidence generation.
• Proven ability to build access request automation covering requests, approvals, and fulfillment.
• Experience automating JML provisioning and deprovisioning across multiple enterprise systems.
• Practical experience integrating and administering Okta as an identity provider, including SSO, MFA, and SCIM-based lifecycle provisioning preferred.
• Experience in a financial services environment preferred.
• Experience supporting ICFR and SOX access controls, including segregation of duties and audit evidence preparation, preferred.
• Familiarity with FFIEC IT examination guidance preferred.
• Bachelor's degree with a major in cybersecurity, computer science or related field preferred, but not required.
• Information security experience may be substituted for requisite education.
• Must be authorized to work for any employer in the U.S.; employment visa sponsorship is unavailable.
• Preferred certifications include SailPoint Certified Identity Now/Identity IQ Engineer, Cyber Ark Defender or Sentry, Okta Certified Professional or Administrator, and CISSP or equivalent.

Demonstrates expertise in Identity and Access Management engineering, with a strong focus on SailPoint Identity Now, Cyber Ark PAM, and automation through Power Shell and REST APIs. Proven ability to design and implement RBAC models and manage access controls in compliance with SOX and ICFR standards.

• SailPoint Identity Now
• Cyber Ark PAM
• Power Shell Scripting
• RBAC Model Design
• Okta Administration

• Identity Governance
• Access Management
• Privileged Access Management
• Lifecycle Workflows
• Certification Campaigns
• Role Mining
• Role Engineering
• JML Provisioning
• REST API Automation
• Entitlement Reconciliation

• SailPoint Certified Identity Now/Identity IQ Engineer
• Cyber Ark Defender
• Cyber Ark Sentry
• Okta Certified Professional
• CISSP

• ICFR
• SOX
• FFIEC IT Examination Guidance
• Financial Services

• Sail Point
• Cyber Ark
• Okta
• Service Now
• ILS