Workforce IAM Engineer

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Workforce IAM Engineer based in the United States. This role sits at the center of enterprise identity and access management, helping secure how employees access applications, systems, and data. You’ll take a hands-on role in designing and maintaining persona-based RBAC across cloud and hybrid environments. The position combines engineering, automation, platform administration, troubleshooting, and security operations at enterprise scale. You’ll work extensively with Microsoft Entra ID, Active Directory, Okta, password management platforms, and hardware security keys. Your work will directly support Zero Trust initiatives while improving reliability and reducing friction for end users. You’ll collaborate with senior engineers, security architects, application teams, and business partners in a highly collaborative environment. This is an opportunity to make meaningful improvements to identity infrastructure while developing expertise across modern security technologies. Accountabilities - Design, build, test, deploy, and maintain persona-based RBAC roles and access policies as applications and workforce personas are onboarded. - Develop scalable application logic, automation, integrations, and workflows across Microsoft Entra ID and Okta. - Configure and maintain application onboarding, SSO, SCIM, and identity automation using Microsoft Graph, Okta APIs, and related technologies. - Develop PowerShell and/or Python scripts and tooling to automate role assignment, provisioning, reporting, and identity workflows. - Maintain RBAC implementations as organizational structures, entitlements, applications, and access requirements evolve. - Write, test, document, and review code in accordance with engineering standards, including appropriate unit testing and version control practices.

- Administer the enterprise password management platform, including vault structures, policies, group and SCIM provisioning, onboarding, offboarding, and upgrades. - Manage the lifecycle of hardware security keys, including enrollment, provisioning, replacements, PIN resets, and recovery of lost or damaged devices. - Coordinate with asset management teams on security-key distribution, reclamation, replacement, and offboarding logistics. - Monitor identity platform health, apply updates, work with vendors to resolve issues, and maintain operational readiness. - Analyze authentication, authorization, and access data to support troubleshooting, audits, and continuous improvement. - Investigate and resolve application access problems, authentication errors, and integration failures, escalating issues when appropriate. - Support end users and partner teams with identity-related requests, RBAC questions, and platform capabilities. - Participate in on-call rotations and respond to identity platform incidents according to established escalation procedures. - Contribute to runbooks, knowledge articles, and technical documentation that improve team efficiency and reduce recurring issues. Requirements - 3+ years of IT engineering experience, including at least 1 year administering an enterprise password management platform; experience with 1Password is preferred, while Keeper or Bitwarden experience is also relevant. - Hands-on experience with Active Directory, Microsoft Entra ID, and Okta, including application onboarding and SSO/SCIM configuration. - Strong understanding of IAM concepts such as RBAC, SSO, SAML, OIDC, MFA, authentication, authorization, and access governance. - Practical experience with hardware security tokens such as YubiKey, Google Titan, or Feitian. - Scripting experience with PowerShell, Python, or both, ideally including Microsoft Graph automation and Entra ID application registrations.