IAM Engineer

Job SummaryThe Senior Engineer, Identity & Access Management designs, implements, andoperatessecure, scalable identity solutions across the enterprise. This hands-on senior engineering role helps protect UFCU's digital ecosystem by ensuring that users and systems haveappropriate accessto resources at the right time. This rolepartners withInformation Security, Platform Engineering, Product Engineering, Infrastructure, and Application teams to embed identity and access controls into UFCU's platforms, applications, and workflows.The Senior Engineer, Identity & Access Management is an exempt position and reports to the Director, Information Security, and is part of the Information Security team at UFCU.About UFCU Our Credit Union was founded in 1936 and has grown to serve members throughout Texas and beyond. At UFCU, we are more than just a financial institution, and our people are more than just employees. We are dedicated to our purpose of empowering our Members to achieve financial success and build brighter futures.In pursuit of our aspiration that UFCU isloved by millions of Members and built to thrive for generations, we are guided by our values:Purposefully Member-Obsessed: We are driven by a profound sense of empathy to deeply understand our Members’ needs and preferences, what brighter futures means to them, and the obstacles in their way. We act in our Members’ best interests, forever seeking to empower their financial success.Possibilities Reimagined: We are inspired to courageously experiment, learn, and iterate in pursuit of positive impact for our Members, UFCU, and coworkers. We challenge assumptions, embrace diverse perspectives, and make use of data and insights.Performance Excellence Rooted in Unwavering Integrity: We do the right thing, always. We champion teamwork, accountability, continuous improvement, and celebrate successful outcomes of others, fostering an inclusive environment of excellence and collaboration.Essential FunctionsIdentity & Access Management Engineering and ArchitectureDesign, implement, and support enterprise identity and access management solutions across workforce, Member, third-party, and non-human identities, including service accounts, workload identities, and artificial intelligence agents.Engineer secure authentication and authorization mechanisms, including single sign-on, multifactor authentication,passwordlessauthentication using Fast Identity Online 2 and passkeys,credential sharding,includingconditional and risk-based accessschemas.Implement andmaintainrole-based access control and attribute-based access control aligned with leastprivilege, least agency,and separation-of-duties principles.Support the key managementprogram, including certificate lifecycle management,secretsmanagement, and application programminginterfacesand model context protocol(MCP) client and server access.Embed identity controls and secure protocols into continuous integration and continuous delivery pipelines, Infrastructure as Code, and modern application architectures.Identity Governance, Privileged Access, and Threat ResponseDeploy and manageleading-edgeIdentity Governance and Administration platforms.Conduct access certifications for regulatory compliance and manage access-request workflows, entitlement management, and role-lifecycle governance.Develop centralized, cross-team processes and procedures related to alljoiner,mover, and leaver activities.Implement and manage Privileged Access Management solutions using just-in-time and just-enough-access models; monitor and audit privileged activity and session recording.Deploy Identity Threat Detection and Response capabilities; monitor identity-related threats and anomalous behavior and integrate identity threat signals with security information and event management, security orchestration, automation, and response, and incident-response workflows.Platform Resilience, Compliance, and Risk ManagementDesign andmaintainhighly availableidentity and access management infrastructure with disaster-recovery capabilities, including redundancy, failover mechanisms, and break-glass access protocols.Align identity and access management controls with the National Institute of Standards and Technology Cybersecurity Framework 2.0 and applicable National Credit Union Administration, Gramm-Leach-Bliley Act, Federal Financial Institutions Examination Council, System and Organization Controls 2, and Payment Card Industry Data Security Standard requirements.Provide audit evidence, documentation, and control explanations for internal and external audits; continuously assess and improve identity and access management controls to reduce identity-related risk.Implement privacy-by-design principles in identity architectures, including data minimization, and support privacy impact assessments.Operational Autonomy and Stakeholder EngagementSupport the development and maintenance of a multi-year identity and access management strategy and roadmap aligned with organizationalobjectives, regulatory requirements, and Zero Trust maturity progression.Present identity risk posture, architecture decisions, and compliance status to the Director, Information Security, executive leadership, and audit committees using business-focused risk language.Lead andfacilitateidentity governance activities with stakeholders from Technology, Information Security, Risk Management, Human Resources, Legal, Compliance, and business units.Evaluate emerging identity technologies, conduct total-cost-of-ownership analysis for platform investments, and lead vendor selection, requests forproposal, and proof-of-concept evaluations.Partner with application, infrastructure, and product teams to design secure access patterns and educate teams on identity and accessmanagementbest practices and regulatory requirements.OtherAdheres to all company policies, procedures, and business ethics codes.Completes required regulatory training as assigned.Maintains strict adherence to and compliance with all laws, rules, regulations, and internal controls specific to the role, including but not limited to Bank Secrecy Act, Anti-Money Laundering, USA Patriot Act, Office of Foreign Assets Control, and Fair Lending regulations.Knowledge/Skills/AbilitiesThis is a senior-level role and requires an advanced level of knowledge, skill, and ability.KnowledgeAdvanced knowledge ofIdentity Lifecycle Management andZero Trust principles.Advanced knowledge of modern authentication and federation standards, including Security Assertion Markup Language, OAuth 2.0, OpenID Connect, mutual Transport Layer Security, JSON Web Token, and Fast Identity Online 2.Familiar with IAM requirements for Payment Card Industry Data Security Standard (PCI-DSS).SkillsConfiguring and administeringIAM platforms, such as Microsoft Entra, Okta,Sailpoint, andSavyint.Experience withadministering conditional access and privileged access policies.Familiarity with supportingSecDevOpsintegration efforts for IAM controls validation.Scripting and automation using PowerShell, Python,andMicrosoft Graph.AbilitiesAbility to diagnose complex identity issues, evaluate technical tradeoffs, and develop secure, supportable solutions.Ability to drive change-management efforts for identity and accessmanagementadoption and transformation.Ability to lead and influence cross-functional stakeholders without direct authority.Ability to mentor and share knowledge with engineers,business partners, and executives.Core CompetenciesDemonstrating Member ObsessionPuts themselves in the Member’s shoesLooks for friction pointsMakes it personalized and easyDemonstrating Performance ExcellenceSets standards for elevating excellenceEnsures elevated qualityTakes responsibilityConducts continuous improvementDemonstrating InnovationChallenges current thinkingApproaches change with a positive mindsetExperienceMinimumRequirements4+years experiencein IAM architecture or engineering Experience managing non-human identitiesat-scale.Bachelor’s degree in computer science, cybersecurity, engineering, or a related fieldor equivalent years of experience Must be bondable.Preferred RequirementsExperience in financial services, fintech, credit unions, oranotherregulated industry.2+ years in an operations or administration capacityFamiliarity with Gramm-Leach-Bliley Act, National Credit Union Administration, and Federal Financial Institutions ExaminationCouncilcybersecurity guidance.Relevant certification, such as Certified Information Systems Security Professional(CISSP), Certified Information Security Manager(CISM), or Certified Cloud Security Professional(CCSP).Physical DemandsThe physical demands described are representative of those that must be met by an employee, with or without accommodation, to successfully perform the essential functions of this job. Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions.FrequentWhile performing the duties of this job, the employeeis regularly required tosit; use hands to finger, handle or feel;reach withhands and arms; and talk or hear.Specific vision abilities required by this job include close vision, distance vision, peripheral vision, and ability to adjust focus.Employeewill make extensive use of the telephone and virtual communications requiring the ability to explain complex information effectively and accurately.Work EnvironmentThe work environment characteristics described are representative of those an employee encounters while performing the essential functions of this job.This position is hybrid, requiring working onsite at UFCU Plaza in Austin, Texas approximately two days per week, with the remaining days worked remotely.This position may involve periodic stressful conditions.May occasionally require an adjusted work schedule, overtime, and evening or weekend hours.May occasionally move from one work location or branch to another.Public contact position, requiringappropriate professionalappearance.Frequent computeruseat a workstationofup to two hours at a time.The noise level in the work environment is usually moderate.Job SummaryRequisition Number: SENIO Job Category: Information TechnologySchedule: Full-Time