IAM Engineer

Role: IAM Engineer
Location: Memphis TN / Dallas TX / Mclean VA
Job Summary:
Seeking a highly skilled and experienced identity engineering professional to lead the implementation, configuration, automation, operation, and troubleshooting of identity platforms supporting agent identities within a complex enterprise environment. This role is at the forefront of an emerging and rapidly evolving discipline, responsible for turning agentic identity and access management strategy into reliable, scalable operating capability. The position requires deep technical expertise across both traditional workforce identity platforms and cutting-edge agentic identity solutions, with a strong emphasis on integrating these capabilities across enterprise AI, security, cloud, and application stacks. A secondary but equally important focus involves identity integration engineering, including onboarding new applications and identity data sources into the IAM data warehouse to strengthen governance, reporting, monitoring, and audit readiness. This is a contract-to-hire opportunity, and the successful candidate will be expected to demonstrate the technical depth, leadership behaviors, collaboration skills, and delivery discipline consistent with a permanent role, while building durable documentation, operating practices, and knowledge transfer to ensure long-term supportability and scalability.
Responsibilities:

• Deploy, configure, integrate, and operate identity capabilities for AI agents, workloads, service accounts, and other non-human identities.
• Engineer SailPoint Agentic Fabric, PingFederate, Ping Authorize, and Ping Agent IAM Core capabilities for discovery, governance, runtime authorization, authentication, lifecycle control, and audit.
• Integrate agentic identity controls with enterprise identity platforms, AI platforms, API and MCP gateways, cloud platforms, directories, secrets platforms, monitoring tools, and business applications.
• Build repeatable implementation patterns for agent onboarding, ownership, policy enforcement, access certification, provisioning, deprovisioning, authentication, authorization, and kill-switch processes.
• Build and maintain provisioning workflows, connectors, integrations, authentication policies, and data stores for non-human identity data.
• Leverage evolving capabilities to maintain updated non-human and agentic identity inventories and ownership, operate and enforce lifecycle controls, produce reporting, detect anomalies, and perform mitigation activities.
• Establish platform operating procedures, installation plans, and configuration runbooks covering agent platform onboarding, connector configuration, NHI discovery, lifecycle workflows, certifications, OAuth client registration, credential management, authorization policies, and SIEM monitoring controls.
• Plan and execute platform upgrades, migrations, configuration changes, and technical remediation activities.
• Provide advanced incident support and diagnose complex failures across identity, application, network, cloud, data, and authentication layers.
• Improve platform reliability, scalability, security, observability, and performance through automation, monitoring, testing, and engineering standards.
• Develop secure APIs, scripts, and automation routines that streamline provisioning, operational processing, monitoring, access governance, and compliance evidence collection.
• Integrate new human and non-human identity and access data sources into the IAM data warehouse using reliable extraction, transformation, validation, reconciliation, and error-handling patterns.
• Create monitoring, alerting, dashboards, and operational analytics using platforms such as Datadog and Splunk.
• Maintain architecture diagrams, operational runbooks, implementation documentation, source-control practices, and engineering standards.

Experience:

• 10 + years of IAM engineering, platform engineering, or identity integration experience in complex enterprise environments.
• Demonstrated experience implementing controls for non-human identities such as AI agents, service accounts, machine accounts, service principals, OAuth clients, and workload identities.
• Experience implementing or transitioning identity services to SaaS and cloud delivery models.
• Hands-on experience with privileged access management platforms such as HashiCorp Vault and OneIdentity Safeguard is preferred.
• Experience with CI/CD pipelines, infrastructure as code, automated testing, and Git-based workflows is preferred.

Skills:

• Deep expertise in IAM engineering, platform engineering, and identity integration within complex enterprise environments.
• Proficiency in implementing controls for non-human identities, including AI agents, service accounts, machine accounts, service principals, OAuth clients, workload identities, and associated credentials and certificates.
• Strong working knowledge of traditional workforce identity platforms, including SailPoint IdentityIQ, PingFederate, PingDirectory, Microsoft Entra, and Microsoft Active Directory.
• Familiarity with support, monitoring, and observability platforms such as ServiceNow, Datadog, and Splunk.
• Proven ability to design, implement, and debug identity lifecycle, authentication, federation, authorization, directory, and provisioning solutions.
• Experience building APIs, connectors, scripts, and automation for operational processing, monitoring, and audit or compliance use cases.
• Working knowledge of HRIS integrations, identity data models, SQL, ETL or data pipelines, logging, and reconciliation controls.
• Strong troubleshooting, documentation, communication, and cross-functional delivery skills.
• Hands-on experience with SailPoint Identity Security Cloud, Agentic Fabric, Entra, Ping Agent IAM Core, PingAuthorize, API or MCP gateways, or comparable non-human identity platforms is preferred.
• Experience with privileged access management platforms such as HashiCorp Vault and OneIdentity Safeguard is preferred.
• Experience with CI/CD, infrastructure as code, automated testing, Git-based workflows, and production support practices is preferred.

Qualifications:

• Relevant SailPoint certifications are preferred.
• Relevant Ping Identity certifications are preferred.
• Relevant Microsoft certifications are preferred.
• Relevant cloud platform certifications are preferred.
• Relevant security certifications are preferred.