Lead Identity & Access Management Engineer

Title: Lead Identity & Access Management EngineerExecutive Area: Information TechnologiesCollege/School/MBU: Information TechnologyDepartment: IT Information SecurityWork Location: AmherstSchedule: Full TimeWork Arrangement: HybridJob SummaryThe Lead Identity and Access Management (IAM) Engineer contributes technical leadership for the university's enterprise-wide identity and access management program. This position is responsible for leading the design, implementation, integration, and continuous improvement of authentication, authorization, identity provisioning, and identity governance and administration (IGA) solutions across all university systems, audience types, and applications. This role combines hands-on technical expertise and cross-functional collaboration. The Lead IAM Engineer helps drive the technical vision and roadmap for IAM services, ensures alignment with institutional security and compliance requirements, and provides guidance to a team of IAM professionals. This position continually manages the risk associated with UMass Amherst's identity and access management posture, collaborating with appropriate stakeholders to implement system-wide improvements that safeguard institutional assets while optimizing usability and value of identity services for the entire university community. This position requires deep expertise in IAM concepts and workflows, IGA platforms, authentication and authorization applications and protocols, and the ability to manage enterprise services in a complex higher education environment.Essential FunctionsLead IAM initiatives:Provide technical leadership and help inform strategic direction for the university's IAM ecosystem, including authentication services, access controls, identity governance, and related middleware that enable secure access to university systems, data, and services. Collaborate on the architectural design, development, and documentation of both legacy and new information systems that support IAM services across on-premises and cloud environments. Configure and maintain the Identity Governance and Administration platform(s), including identity lifecycle design and management, automated provisioning and deprovisioning, access requests and approvals, rectifications and entitlement management. Design and implement enterprise IAM service architecture including Single Sign-On (SSO), Multi-Factor Authentication (MFA), identity federation, and automated provisioning workflows. Analyze complex technical problems and develop innovative solutions, exercising a high level of originality, ingenuity, and application expertise. Research and evaluate available solutions, recommend adoption strategies, and lead integration efforts within existing computing environments. Install, configure, and maintain operating system components, applications and application servers, and integrations that support IAM infrastructure. Collaborate with system owners, administrators, and stakeholders to implement appropriate IAM standards and best practices across all university systems. Manage and optimize user provisioning and de-provisioning processes across the identity lifecycle. Ensure periodic access reviews and access certifications are performed, documented, and remediated. Proactively apply appropriate levels of IAM related auditing and monitoring across university systems. Collaborate with IT security team, system administrators, stakeholders, and external partners and vendors to integrate identity and access management solutions. Regularly review, evaluate, and update access policies based on changing organizational needs and compliance requirements. Communicate effectively with customers and stakeholders to elicit requirements, present solutions, and investigate and resolve issues. Compliance, Security, and Risk Management:Ensure that IAM systems remain in documented compliance with relevant frameworks, regulations, and agreements (e.g., NIST, FERPA, HIPAA, PCI-DSS, CMMC). Research, recommend, and promote IT security policies and guidelines focused on protecting the confidentiality, integrity, and availability of university accounts, data, and computer assets both local and in the cloud. Monitor and audit access controls to prevent unauthorized access and detect anomalous activity. Participate in incident response and security incident investigations related to access control breaches.Other FunctionsStay informed about industry trends and emerging technologies related to identity and access management.Represent the IAM function in university-wide committees, working groups, and governance bodies as needed.Perform other duties as requested or required, whether or not specifically mentioned in this position description.Minimum QualificationsBachelor's degree in computer science, information technology, cybersecurity, or related field with more than 9 years of progressive professional IT experience.-OR- Associate's degree in computer science, information technology, cybersecurity, or related field with more than 11 years of progressive professional IT experience.5 years of experience focused on identity and access management. 2 years of experience in a technical lead or team lead capacity, providing guidance, mentorship, or oversight to technical staff. Demonstrated expertise in identity and access management systems (e.g., Active Directory, Azure AD/Entra ID, LDAP, identity governance platforms). Strong knowledge of security protocols and authentication methods (e.g., SAML, OAuth 2.0, OpenID Connect, Kerberos, RADIUS). Strong understanding of and experience with information security frameworks, privacy laws, and regulatory requirements (e.g., NIST, FERPA, HIPAA, PCI-DSS). Demonstrated experience in architectural design and implementation of identity and access management best practices. Proficiency in identity lifecycle management, including automated provisioning, de-provisioning, and access certification processes. Experience with cloud-based identity management solutions and hybrid identity architectures. Excellent written and verbal communication skills with the ability to communicate effectively with both non-technical end-users, executive stakeholders, and technical staff. Demonstrated ability to lead technical teams, set priorities, and drive projects to completion. Excellent organizational and time management skills with the ability to multi-task and adjust to rapidly changing priorities. Strong problem-solving and analytical skills with the ability to conduct complex risk assessments. Excellent customer service skills with the ability to provide efficient technical support to diverse audiences. Ability to work in a fast-paced team environment and quickly adapt to new technologies.Preferred QualificationsMaster's degree in computer science, cybersecurity, information technology, or a relevant field.Industry certifications such as CISSP, CISM, CISA, or vendor-specific IAM certifications (e.g., Microsoft Identity and Access Administrator, Certified Identity and Access Manager).Expert knowledge of Fischer Identity, Azure AD (Entra ID)/SSO/Active Directory, and Cirrus Identity.Expert knowledge of access control models including RBAC, ABAC, and PBAC.Experience in higher education or other large, complex organizations serving diverse user populations.Experience with identity governance and administration (IGA) platforms and workflows.Knowledge of zero trust architecture principles and their application to IAM.Experience with API security, service accounts, and non-person entity management.Supervisory experience managing a small team including conducting performance evaluations.Excellent policy and procedure development skills.Additional DetailsThis role may require occasional travel between campuses or off-site locations.On-call availability may be required for critical IAM system incidents as business needs dictate.This position is subject to final budgetary and administrative approval.Working ConditionsWork is performed in a standard office or indoor university environment and involves minimal physical exertion.Work Schedule and Work ArrangementMonday to Friday, 8:30pm - 5pmThis position has the opportunity for a hybrid work schedule, which is defined by the University as an arrangement where an employee’s work is regularly performed at a location other than the campus workspace for a portion of the week. As this position falls within the Professional Staff Union, it is subject to the terms and conditions of the Professional Staff Union collective bargaining agreement.Salary InformationPay Grade: PSSAP Grade 29Click here to view the Professional Staff Hiring RangesSpecial Instructions for ApplicantsAlong with application, please submit a resume. References will be checked at the finalist stage please be prepared to provide contact information for three (3) professional references.This position will remain open for the time period required by any applicable collective bargaining agreement and will continue until a suitable candidate pool is identified. Interested applicants are strongly encouraged to apply early.