Staff IAM Engineer - Executive Support

We’re building a world of health around every individual – shaping a more connected, convenient and compassionate health experience. At CVS Health®, you’ll be surrounded by passionate colleagues who care deeply, innovate with purpose, hold ourselves accountable and prioritize safety and quality in everything we do. Join us and be part of something bigger – helping to simplify health care one person, one family and one community at a time.

The Staff IAM Engineer – Executive Operations plays a critical role in ensuring the reliability, security, and effectiveness of the organization’s identity and access management services. This position is responsible for supporting and improving core IAM operations across Active Directory, Entra , cloud IAM platforms, and privileged access solutions, helping ensure users have the access they need while maintaining strong security controls and compliance with regulatory requirements.

Through operational excellence, process improvement, and technical expertise, the role helps strengthen the organization’s identity security posture and advance the maturity of the IAM program.

In addition to supporting enterprise IAM operations, this role provides specialized support for executive leadership and other high‑profile users, requiring a high degree of professionalism, discretion, and responsiveness. Acting as a trusted partner to executives and senior stakeholders, the Staff IAM Engineer helps resolve complex access issues, navigate sensitive situations, and deliver a high‑touch service experience in a 24x7 environment.

• Support execution of enterprise IAM strategy across cloud and hybrid identity platforms.
• Implement and maintain cloud‑first identity patterns leveraging Entra  supporting and modernizing on‑premises Active Directory.
• Enforce IAM best practices, including least privilege, group‑based access controls, and time‑bound privileged access.
• Support Active Directory security hardening, baseline configurations, and enterprise control requirements.
• Contribute to Privileged Access Management (PAM) solutions for human and service identities.

• Partner with Security, Infrastructure, GRC, and Application teams to implement and enhance IAM controls and services.
• Serve as a senior technical escalation point for complex identity and access management issues.
• Provide guidance on IAM risks, access decisions, and security design tradeoffs.
• Support audit, regulatory, and compliance activities, including HIPAA and SOX requirements.

• Design and maintain Active Directory organizational structures, Group Policy configurations, and access management models.
• Develop and maintain permission structures that reduce privilege creep and support least‑privilege access.
• Analyze identity and access data to support security investigations, audits, and compliance reviews. Participate in access certification reviews and remediation efforts for excessive or inactive access.
• Support secure IAM architecture patterns across cloud and hybrid environments.

• Monitor and improve IAM service health, availability, and operational performance.
• Lead troubleshooting and root cause analysis for complex identity‑related incidents and service disruptions.
• Support identity lifecycle processes including provisioning, deprovisioning, and access modifications.
• Maintain operational procedures, runbooks, and technical documentation.
• Participate in on‑call rotations and incident response activities.
• Support disaster recovery and business continuity planning for IAM platforms.
• Identify recurring operational issues and drive long‑term remediation and service improvements.

• Provide dedicated support for executive leadership and other high‑priority users requiring expedited identity and access services.
• Manage sensitive access requests, escalations, and incidents with professionalism, discretion, and urgency.
• Build trusted relationships with executive stakeholders while ensuring adherence to security policies and access governance standards.
• Deliver a high‑touch support…