> Markdown version of [/jobs/ext/2306227-principal-iam-engineer](https://www.wearedevelopers.com/jobs/ext/2306227-principal-iam-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Principal IAM Engineer - **Company:** Lantern - **Location:** Dallas, TX, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Microsoft Azure, Software as a Service, Cloud Engineering, Github, Identity and Access Management, Python (Programming Language), Key Management, OAuth, OpenID, Windows PowerShell, Role-Based Access Control, Phishing, Zero Trust Network Access, Security Assertion Markup Language (SAML), Single Sign-On, Policy as Code, Power Platform Integration, SailPoint, Terraform - **Published:** August 30, 2026 - **Apply:** https://www.dice.com/job-detail/35bf81f4-110e-40bf-915a-92aa8d975a5f ## About the Role * Eight or more years in identity and access management, including principal- or staff-level ownership of an identity control plane., * Healthcare or another regulated environment where identity controls gate access to PHI. * Hands-on Saviynt with PAM, Azure PIM, and Keeper, or transferable depth in comparable platforms. * Experience remediating a Conditional Access enforcement gap or a deprovisioning failure, and making the structural change that prevented recurrence. * Passkeys and FIDO2, or phishing-resistant authenticator experience, aligned with NIST SP 800-63 Rev. 4. * Experience growing a technical scope into a broader leadership remit. * Microsoft Identity and Access Administrator certification, CIMP, or equivalent., * You use LOGIC in your decision making and understand that progress is critical to making change. You focus on the execution of your content while balancing a fast-paced environment and you take the time to celebrate both the small & big wins. * INCLUSION is a core tenant of your personal beliefs. A diverse and inclusive environment is incredibly important to you. You understand and desire to be a part of a diverse team with different experiences and perspectives & you cherish the differences in each individual that you interact with. * You have the GRIT, drive and ambition to tackle big problems. Big problems require big ideas and a team that supports new ideas. * You care deeply for your customers are driven to keep HUMANITY in all decisions. Your customers aren't just the individuals using your product. They are the driving factor in your motivation to make a change. * Integrity guides you in life. Focusing on the TRUTH vs. giving people the answers they want to hear. * You thrive in a Team Environment. Collaboration is key in innovation and creating change. ## Description This Principal IAM Engineer is a senior level, individual-contributor role and the technical authority for identity at Lantern. In an organization where the security perimeter is effectively identity, you will own the identity control plane end to end, and you will determine who can reach PHI and under what conditions. You will set the identity standard, build the automation behind it, and hold the verification bar that other teams operate against. You will report to the CISO and partner closely with our IAM engineer and with the platform, cloud, and service delivery teams that execute alongside you. This is a hands-on principal seat, not a people-management role today, with a clear path to expand into a leadership role as the identity function grows. Our security philosophy is open by default, secure by design. Security exists to help the business move fast, safely, and the default answer is "yes, safely," because guardrails are built into the platform, pipelines, and tooling rather than enforced by someone saying no. Gates exist only where risk genuinely warrants them, and even then they are automated, fast, and transparent., * Own the identity lifecycle: joiner, mover, and leaver provisioning and deprovisioning, automated from role- and attribute-based models (RBAC/ABAC), with deprovisioning verified against an entitlement inventory rather than assumed. * Own access management, including Conditional Access, phishing-resistant MFA, and privileged access on a Zero Trust model, with least-privilege by default, just-in-time (JIT) elevation, and enforcement confirmed on every access path rather than only saved. * Own directory and federation across Entra ID, single sign-on, SAML, OIDC, and OAuth2. * Own secrets and non-human identity, including API keys, service accounts, and workload identity, and maintain an owner registry for them. * Own key access governance and separation of duties in a model where another team operates the key management system. * Own identity automation and identity-as-code, building lifecycle and access controls as reviewable, version-controlled infrastructure (Terraform and policy-as-code) rather than manual configuration. * Own the identity-verification standard the service desk follows for password resets, MFA resets, and device enrollment. This is a hands-on control point, because helpdesk-initiated resets are a leading account-takeover vector. Key Deliverables in Your First Year: * Conditional Access enforced by default on PHI-facing applications, with enforcement verified. * Automated joiner, mover, and leaver provisioning and deprovisioning that meets its SLA every time. * A secrets golden path, with vaulted secrets, none in code, and a populated key-to-owner registry. * Strong, phishing-resistant MFA coverage on privileged accounts. * Documented runbooks and depth across the control plane, so no critical control depends on a single person. How You Will Work:You will set standards that partner teams execute. Service Delivery performs provisioning tasks and resets against the verification bar you own. Cloud Engineering carries cloud access, workload identity, and key-management operations, with key access governed by you. HR events are the sole trigger for lifecycle changes. The Governance, Risk & Compliance team independently attests to the entitlements you produce, and access certification deliberately sits outside this role so that the team reviewing access is not the team granting it. Holding those boundaries cleanly is central to the job., * Identity lifecycle automation across cloud, SaaS, and privileged systems, with role- and attribute-based provisioning (RBAC/ABAC) and deprovisioning verified against an entitlement inventory. * Zero Trust identity design, including least-privilege, just-in-time (JIT) access, and risk-based or adaptive access controls. * Identity governance and administration (IGA) platform engineering, including privileged access management. * Automation and scripting (PowerShell, Python, or similar) to build lifecycle workflows and custom connectors. * Identity-as-code and policy-as-code practice, using Terraform with source-controlled change management (for example, GitHub). * Secrets and non-human identity (API keys, service accounts, workload identity), and maintaining an owner registry for them. * Key access governance and separation of duties in a model where another team operates the key management system. * The ability to act as the technical authority for a function without formal people-management authority, working directly to a CISO. * Bachelor's degree in a relevant field, or equivalent professional experience., * Verified enforcement. You do not consider a control done until you have seen it working on every path. * Automation bias. You remove the manual step rather than documenting it more carefully. * Structural fixes. You solve the class of failure, not the instance. * Boundary clarity. You hold the standard with partner teams without taking over their execution. * Governance respect. You keep access certification independent rather than absorbing it. ## Related Videos - [Keeping applications secure by evolving OAuth 2.0 and OpenID Connect](https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect) - [Innovating Developer Tools with AI: Insights from GitHub Next](https://www.wearedevelopers.com/videos/1268-innovating-developer-tools-with-ai-insights-from-github-next) - [Our GitOps approach for deploying an Identity Provider and an API Gateway in a SaaS company](https://www.wearedevelopers.com/videos/776-our-gitops-approach-for-deploying-an-identity-provider-and-an-api-gateway-in-a-saas-company) - [CI/CD with Github Actions](https://www.wearedevelopers.com/videos/856-ci-cd-with-github-actions) - [Get started with securing your cloud-native Java microservices applications](https://www.wearedevelopers.com/videos/123-get-started-with-securing-your-cloud-native-java-microservices-applications) - [Delegating the chores of authenticating users to Keycloak](https://www.wearedevelopers.com/videos/1558-delegating-the-chores-of-authenticating-users-to-keycloak) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Navigating the AI Shift](https://www.wearedevelopers.com/magazine/629-navigating-the-ai-shift) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Trustworthy AI Starts at Deployment: 5 Checks Before You Ship](https://www.wearedevelopers.com/magazine/753-trustworthy-ai-starts-at-deployment-5-checks-before-you-ship) - [The Best X (Twitter) Accounts for Developers](https://www.wearedevelopers.com/magazine/294-the-best-x-twitter-accounts-for-developers)