Senior Identity & Access Management Engineer

The Life Time Technology team is at the forefront of the evolution of Life Time into a digital-first company, transforming existing experiences and creating brand new ones both online and in our clubs. If you enjoy a fast-paced environment with the latest technologies and have a passion for health and fitness – we should meet. Work is a team effort, and we are a highly motivated, highly collaborative team; we always win or lose together. We invest in our team members and ensure they have the tools and opportunities to learn, grow and thrive. We offer an incredible benefits package, generous club discounts, and a fully subsidized Signature Life Time Membership. Want to Love Your Life? Join our team.Position SummaryWe are seeking a skilled Identity & Access Management (IAM) Engineer to join our Information Technology Team. In this role, you will be responsible for designing, implementing, and maintaining enterprise identity and access management solutions that protect our organization's critical resources while enabling seamless user experiences.You will work across a modern IAM stack including cloud identity platforms, privileged access management, directory services, and email security with PingOne, PingOne DaVinci, SailPoint Identity Cloud, CyberArk Privilege Cloud, Microsoft Active Directory, Exchange On-Premises, Mimecast, Microsoft 365, and OAuth 2.0 On-Behalf-Of (OBO) token flows for API-to-API authentication.— partnering closely with IT, Security, and Business stakeholders to ensure robust, scalable, and compliant access controls.Job Duties and ResponsibilitiesIdentity Platform Administration (SailPoint / PingOne)Design, configure, and maintain PingOne identity platform including SSO, MFA, and user lifecycle managementBuild and manage identity orchestration workflows using PingOne DaVinci, including policy-driven authentication flows and integration connectorsIntegrate applications via SAML 2.0, OIDC, and OAuth 2.0 with PingOne as the Identity Provider (IdP).Administer and extend SailPoint Identity Cloud for identity governance, access certifications, role management, and automated provisioning/deprovisioningDefine and enforce access governance policies, separation of duties (SoD) rules, and recertification campaigns across enterprise applications.Develop connectors, workflows, rules, and reports within SailPoint to meet compliance and audit requirements (SOX, HIPAA, PCI.).Maintain identity data integrity across connected systems and authoritative sourcesPrivileged Access Management (CyberArk Privilege Cloud)Administer CyberArk Privilege Cloud to manage, monitor, and audit privileged account accessOnboard privileged accounts (Windows, Linux, network devices, databases, cloud service accounts) and enforce least privilege principlesDevelop and maintain CyberArk platform policies, master policies, and credential rotation schedules.Respond to PAM-related incidents and conduct periodic privileged access reviewsIntegrate CyberArk with enterprise systems and automate credential rotation workflowsDirectory Services and Active DirectoryManage and maintain Microsoft Active Directory infrastructure including forests, domains, OUs, GPOs, and trustsSupport AD health monitoring, replication, and performance tuningMaintain and optimize Group Policy Objects (GPOs) for security hardening and complianceExecute AD lifecycle management: user and group provisioning, access reviews, and cleanupEmail and Messaging Security (Exchange On-Premise / Mimecast)Administer Microsoft Exchange On-Premises environments including mailbox management, transport rules, and connectorsManage Mimecast email security including policy configuration, threat protection, and continuity servicesOversee Microsoft 365 messaging services including Exchange Online, Teams, and related workloadsRespond to email security incidents including phishing, spoofing, and mail flow issuesMicrosoft 365 and Cloud IdentityAdminister Microsoft 365 tenant including licensing, conditional access, and security baselinesConfigure and maintain Azure AD / Entra ID integration with on-premises AD via hybrid join and syncImplement and manage M365 security features including MFA enforcement, Privileged Identity Management (PIM), and compliance policiesCollaborate on M365 governance, data loss prevention (DLP), and access control policiesAPI Authentication & OAuth 2.0 On-Behalf-Of (OBO) FlowsAdminister Microsoft 365 tenant including licensing, conditional access, and security baselinesDesign and implement API-to-API authentication patterns using the OAuth 2.0 On-Behalf-Of (OBO) token flow — enabling services to call downstream APIs on behalf of authenticated users.Register and manage app registrations, service principals, API permissions, and consent frameworks in Microsoft Entra ID and PingOne.Collaborate with development teams to review token scopes, audience validation, token lifetime policies, and secure token storage practices.Implement and enforce token validation, refresh token rotation, and mTLS certificate-bound token strategies where applicable.Document OBO flow architectures and provide guidance on secure service mesh and microservices identity patterns.Security, Compliance and GovernanceConduct periodic access certification campaigns and remediate inappropriate entitlementsEnsure IAM solutions comply with regulatory frameworks such as SOX, HIPAA, NIST, and ISO 27001Document IAM processes, runbooks, and architecture decisionsParticipate in security audits and support evidence collection for access-related controlsProactively identify and remediate identity-related risks and vulnerabilitiesIntegration and AutomationDevelop and maintain integrations between IAM platforms using REST APIs, SCIM, LDAP, and SAMLBuild automation scripts (PowerShell, Python, or similar) to streamline IAM operationsCollaborate with application teams to onboard new applications to SSO and provisioning workflowsPosition Requirements7+ years of experience in Identity & Access Management or related Information Security rolesHands-on experience with PingOne and/or PingOne DaVinci (or comparable CIAM/IDP platform)Demonstrated experience with SailPoint IIQ or IdentityNow (governance, provisioning, certifications)Practical knowledge of CyberArk Privilege Cloud or CyberArk PAM On-PremisesStrong proficiency in Microsoft Active Directory administration (forests, GPOs, trusts, replication)Experience administering Microsoft Exchange On-Premises (2016/2019)Working knowledge of Mimecast administration and policy configurationExperience managing Microsoft 365 tenant administration and security featuresSolid understanding of IAM protocols and standards: SAML, OAuth 2.0, OIDC, SCIM, LDAPProficiency in PowerShell scripting for automation and administrationFamiliarity with identity governance concepts: RBAC, SoD, least privilege, access certificationsPreferred QualificationsRelevant certifications such as:Ping Identity Certified ProfessionalSailPoint Certified Identity CloudCyberArkMicrosoft Certified: Identity and Access Administrator Associate (SC-300)CISSP, CISM, or CompTIA Security+Experience with Azure AD / Microsoft Entra ID in hybrid identity environmentsExposure to Privileged Identity Management (PIM) and Just-in-Time (JIT) access modelsFamiliarity with Zero Trust architecture principlesExperience with ITSM platforms (ServiceNow, Jira) for access request workflowsKnowledge of Python or another scripting language for IAM automationPrior experience with identity audit support and SOX / PCI / HIPAA compliancePayThis is a salaried position starting at $118,000.00(or applicable minimum salary, if higher) and pays up to $163,000.00, based on experience and qualifications.BenefitsAll team members receive the following benefits while working for Life Time:A fully subsidized membershipDiscounts on Life Time products and services401(k) retirement savings plan with company discretionary match (21 years of age and older)Training and professional developmentPaid sick leave where required by lawFull-time Team Members are eligible for additional benefits, including:Medical, dental, vision, and prescription drug coverage Short term and long term disability insuranceLife insurancePre-tax flexible spending and dependent care plansParental leave and adoption assistancePaid time off, including 5 to 20 vacation days per calendar year (based on tenure) and paid sick leaveDeferred compensation plan, if the team member meets the required income thresholdLife Time is a place for everyone. As an organization, we are committed to an inclusive, diverse and equitable workplace that respects and celebrates the unique contributions of each individual while ensuring we remain an equal opportunity employer that recruits, hires, trains and promotes based on merit and qualifications.Job SummaryJob number: R-177289Profession: Technology