Identity Infrastructure Engineer

The Identity Infrastructure Engineer combines analytical ability, technical skills, security orientation, and creative thinking to contribute to IAM projects, engineering, and operations. They collect requirements, evaluate technologies, and recommend solutions for identity and access management services. They apply sound security orientation and customer focus to deliver high quality services. They are responsible for or oversee specific areas in the planning, design, installation, testing, and maintenance of various security and data protection technologies that support the teaching, research, and business functions of the university.

The Engineer collaborates with members of both IAM and other teams on the design, development, and operation of application interfaces, data flows, and authentication services both on premise and in cloud services. They leverage emerging and established technologies such as continuous integration pipelines, infrastructure‑as‑code, and container orchestration to deploy, configure, and maintain applications. They evaluate, deploy, and operate vended services and internal tools.

They plan transition of legacy systems to modern replacements, evaluate new and emerging access management solutions, and stay current with industry developments. They participate in on‑call and after‑hours duties as required.

The person in this position works both on teams and independently, requiring only limited supervision.

This is a hybrid position, based in Princeton, NJ.

• Collect requirements, recommend solutions, configure software, and create scripts to manage and maintain the enterprise account lifecycle management infrastructure and software.
• Develop, configure, maintain, and administrate enterprise identity and security systems including directory services (Active Directory), cloud IAM solutions (EntraID), single sign‑on services, multi‑factor authentication systems, attribute‑based access controls, password management solutions, and others.
• Develop and deploy continuous integration/deployment pipelines, container orchestration, script‑based automation, and software solutions to support IAM services and applications as required.
• Provide advice, consultation, training, and tooling to campus partners wishing to take advantage of the IAM services enumerated above.

• Serve as a primary subject expert for one or more of the following technologies:
  • Public Key Infrastructure and certificates
  • Microsoft Active Directory
  • Microsoft Identity Manager
  • Single Sign‑On services including SAML2 and Open‑
  • Microsoft EntraID
  • Attribute‑Based Access Control using groups
  • Scripting and automation
  • Apache/Tomcat/IIS operations
• Serve as a secondary subject matter expert for one or more of the above.
• Utilize continuous integration/deployment pipelines to manage software configurations, deploy and update applications, and deliver security patches to IAM applications both on‑premises and in cloud services.

• Troubleshoot and resolve authentication and authorization application problems, access control issues, and other IAM support needs as required.
• Document code and configurations.
• Respond to requests and incidents raised in the IT Service Management system.
• Participate in after‑hours on‑call rotation.
• Ensure services and systems are reliably monitored for security and performance.
• Ensure compliance with change management and other administrative policies.

• Build technical expertise in security operations, security engineering, identity and access management, software development security, cloud migrations and operations, and others as required.
• Learn the functions of new software products to facilitate the use of emerging technology.

• Five (5) years of systems development experience, including analysis, design, implementation, and operations, including three (3) years of experience with IAM technologies such as user provisioning, authentication, authorization, and access management.
• Experience with Microsoft Active Directory, Single Sign‑On (SAML2, OIDC),…