IT Engineer - Cloud & Identity

The IT Engineer - Cloud & Identity at PTMA Financial Solutions is responsible for engineering and operating the identity, access management, and cloud productivity platforms that support more than 300 employees across 10+ office locations. This role owns the full identity lifecycle - from SSO and MFA policy to automated provisioning and access governance - and manages the organization’s cloud productivity and email security environment. Reports to the Corporate IT Manager., * Own and operate the full identity stack: SSO configuration, MFA policy, Conditional Access design, user provisioning and deprovisioning, access reviews, and identity governance (e.g., Okta, Microsoft Entra ID, or equivalent).

• Serve as enterprise application owner for the organization and technical admin owner for all Corporate IT-managed SaaS platforms: manage SSO integrations, application provisioning, licensing, email security, email authentication DNS (SPF, DKIM, DMARC), and platform health (e.g., Microsoft 365, Proofpoint, or equivalent).
• Lead identity and cloud platform projects: system migrations, platform consolidations, new application integrations, and joiner/mover/leaver (JML) automation improvements.
• Collaborate cross-tower with the Network & Security Engineer and Systems Administrator on shared projects and cross-domain automation; build and maintain automation scripts for identity and provisioning workflows (e.g., PowerShell, Python, or equivalent); participate in rotating on-call coverage for Sev-1 and Sev-2 incidents.
• Serve as the Tier 2 escalation point for identity and cloud productivity issues; generate and maintain compliance and audit reporting for all identity platforms: access reviews, provisioning audit trails, MFA/SSO coverage, and identity governance reports; deliver to Corporate IT Manager on a defined cadence., * Work Schedule: This is a hybrid role in our Naperville or Denver office. Tuesday, Wednesday, and Thursday are mandatory in-office days. Monday and Friday are remote. Occasional in-office presence on Mondays, Fridays, or weekends may be required depending on active projects, deployments, or business needs.
• Travel: Occasional travel to PTMA office locations across the United States is required (estimated 15-20%). This is a multi-site environment and site visits are part of the role.
• On-Call: This role includes rotating on-call coverage for after-hours Sev-1 and Sev-2 incidents.
• Evolving Responsibilities: Responsibilities are defined at time of hire and subject to change as the organization scales and team needs develop.

Candidates must be authorized to work in the United States without employer sponsorship now or in the future. This role is not eligible for visa sponsorship or transfer., * 3+ years in a cloud, identity, or systems engineer role supporting a production environment of 100 or more users.

• Hands-on experience with at least one enterprise IAM platform: SSO, MFA policy, provisioning, and access review administration (e.g., Okta, Microsoft Entra ID, or equivalent).
• Experience with Microsoft 365 tenant administration: licensing, service health, security policies, and email authentication.
• Scripting proficiency in PowerShell or Python; demonstrated use of automation for identity lifecycle or provisioning tasks.
• Relevant certifications preferred (e.g., SC-300, AZ-104, MS-100, or equivalent).

Physical Requirements:

• Must be able to work at a computer for extended periods of time.
• Must be able to lift up to 30 lbs. when handling IT equipment and hardware shipments.
• Must be able to travel to PTMA office locations across the United States as needed.