IAM Engineer

At Subway, we are not standing still. We are building.

This is a business focused on what matters most: growing franchisee profitability, strengthening our brand and creating long‑term value. The people who thrive here are the ones who want to make a real impact.

You will not just do the work. You will shape it.

We move fast. We think like owners. We make decisions that matter. We hold ourselves to a high standard because what we do directly impacts thousands of franchisees around the world.

If you bring energy, accountability and a bias for action, you will fit right in.

We take the work seriously, but we also know the best results come from teams that support each other, celebrate wins and show up ready to build something better every day.

This is your chance to be part of what’s next.

The IAM Engineer builds and operates the day‑to‑day identity and access management capabilities that keep Subway's workforce productive and secure. Subway runs a modern, broker‑centered identity architecture: an HRIS‑driven identity pipeline feeds Okta as the identity broker and primary SSO provider, which federates and provisions access across a hybrid estate spanning Active Directory, Microsoft Entra , Microsoft 365, Service Now, AWS IAM Identity Center, and a broad SaaS portfolio.

This is a hands‑on operational and engineering role — owning the daily health of the identity platform while building the automation that steadily retires manual work. The role carries a clear development path toward senior‑level identity engineering, including deeper federation and protocol work, access governance, identity threat detection, and security architecture.

• Operate the identity platform day to day: new SSO application setup, access request fulfillment and escalations, MFA management, group and access cleanup, and account lifecycle corrections; troubleshoot provisioning and authentication issues end to end — SCIM sync failures, attribute mismatches, SSO errors — performing root‑cause analysis and documenting resolutions as runbooks.
• Handle complex onboarding, offboarding, and HR‑driven downstream changes outside automated lifecycle flows, treating offboarding as security‑critical work; manage IAM tickets and service requests in Service Now meeting SLA targets; serve as an internal escalation point for complex identity issues from the Technology Support Center and business teams.
• Build Okta Workflows for identity lifecycle events, application provisioning, and remediation tasks; expand the Okta access catalog to convert recurring ticket categories into governed self‑service with owner/manager approval; implement joiner/mover/leaver automation driven by HRIS events; contribute to AWS access self‑service through AWS IAM Identity Center permission sets.
• Script operational automation in Power Shell or Python — reconciliation, reporting, cleanup, and provisioning tasks; participate in upgrades, patching, and change tickets for identity infrastructure, and the team's shared on‑call rotation.
• Operate SCIM 2.0 provisioning between Ceridian Dayforce, Okta, and downstream systems including Active Directory, Entra , Service Now, Jamf, Microsoft 365, and AWS IAM Identity Center; support the transition off a legacy custom SCIM connector to broker‑native provisioning; configure SSO integrations (SAML 2.0, OIDC) for new applications.
• Apply least‑privilege principles in daily access work — right‑sized group and role assignments, time‑bound privileged access, and cleanup of dormant or over‑privileged accounts; support Okta Identity Governance operations including access certification campaigns; administer non‑human identities and service accounts for LLM and agentic AI integrations applying least‑privilege credential‑scoping patterns.
• Collaborate with the broader Cybersecurity engineering teams on shared projects; assist investigations of access anomalies alongside senior engineers and the Detect & Respond team; support internal and external audits with access evidence; author and maintain runbooks, knowledge‑base articles, and hand‑off documentation for new automations.

• Bachelor's degree in Computer…