IAM Engineer

We are looking for IAM Engineer @ Jersey City, NJ

Profile Description

12+ years in Cybersecurity/IAM roles, including a minimum of 5 years of hands-on SailPoint and enterprise Active Directory/Entra ID administration; prior experience in financial services or another highly regulated, multi-country environment is strongly preferred.

Role Summary

Acts as the dedicated Cybersecurity/IAM counterpart to the Data Governance-led team, translating approved RBAC/ABAC role and coverage definitions into governed SailPoint roles and Active Directory/Entra ID security groups, and ensuring every entitlement change is provisioned, approved, recertified, and audited through the client''s existing identity governance ecosystem.

Key Responsibilities

• Co-author RBAC/ABAC policy definitions with the Data Governance Architects and Business Analyst, ensuring technical feasibility within SailPoint and AD/Entra ID.
• Design and configure the role-to-group mapping schema between the entitlement taxonomy and Active Directory security groups.
• Configure SailPoint roles, access request/approval workflows, and recertification campaigns aligned to SmartApproval and Firmwide Certification.
• Configure Entra ID roles, access request/approval workflows, and recertification campaigns aligned to SmartApproval and Firmwide Certification.
• Design SailPoint and Entra ID certification campaigns (scope, reviewers, frequency, and escalation rules) aligned to the tri-annual Firmwide Certification cycle.
• Administer elevated-permission and break-glass access (HR-for-HR, Operating Committee, senior/peer) with documented approval chains.
• Integrate SailPoint and Entra ID audit and certification events with Splunk for monitoring, alerting, and evidence capture.
• Support UAT, negative testing, and production cutover for all IAM-layer components.
• Co-author the IAM sections of the operational runbook and lead related knowledge-transfer sessions.

Required Technical Skills

• Hands-on SailPoint (IdentityIQ or IdentityNow) role, workflow, and certification configuration.
• Hands-on Entra ID role, workflow, and certification configuration.
• Active Directory / Entra ID security-group administration at enterprise scale (multi-thousand group environments).
• RBAC and ABAC policy design; entitlement/role-catalog modeling.
• ServiceNow access-request/workflow integration.
• Working knowledge of data-layer entitlement enforcement tools (e.g., Immuta, Databricks Unity Catalog) to align IAM groups with downstream policy consumption.
• Scripting/API experience for SailPoint connectors and automation (e.g., PowerShell, Python, REST APIs).
• Log/audit integration experience with SIEM platforms (Splunk preferred).
• Experience operating within regulated, multi-country financial-services environments.

Certifications (Preferred, Not Mandatory)

• SailPoint Certified IdentityIQ Engineer / IdentityNow Engineer.
• CISSP or CISM.
• Microsoft Identity and Access Administrator (SC-300).
• ITIL Foundation.