Identity Operations Engineer

• Nordstrom is seeking an experienced Identity Operations Engineer to support identity and access management across a hybrid, multi-cloud environment using Microsoft Entra ID and SailPoint Identity Security Cloud (ISC).
• This is a hands-on operations role focused on managing joiner, mover, and leaver (JML) processes, fulfilling access requests, troubleshooting provisioning and synchronization failures, and automating repetitive identity operations. The engineer will collaborate with Identity Architecture, HR, ITSM, application owners, and Security Operations teams to improve operational efficiency, security, and compliance., Identity Lifecycle Operations
• Process joiner, mover, and leaver (JML) requests through ITSM queues within established SLAs, including account creation, access changes, role assignments, and deprovisioning.
• Operate SailPoint ISC, including access requests, provisioning failure remediation, aggregation monitoring, identity refreshes, and identity attribute troubleshooting.
• Administer Microsoft Entra ID, including users, groups, licenses, application role assignments, guest accounts, Lifecycle Workflows, and Entitlement Management.
• Troubleshoot HR-to-identity provisioning and synchronization issues between Entra ID and on-premises Active Directory using Entra Connect or Cloud Sync.
• Handle Privileged Identity Management (PIM) and privileged access requests with appropriate approvals and audit trails.
• Conduct access reviews, identify orphaned and dormant accounts, and prepare audit evidence for SOX, PCI, and other compliance requirements.

Automation and Continuous Improvement

• Develop automation using PowerShell, Microsoft Graph, Python, SailPoint ISC APIs, and workflows.
• Build event-driven workflows using Azure Automation, Logic Apps, and Power Automate, integrating with ITSM systems for automated fulfillment and ticket closure.
• Analyze ticket trends to identify automation opportunities and measure operational time savings.
• Maintain production-quality automation through source control, peer reviews, testing, and logging.
• Develop runbooks and knowledge articles and provide escalation support to the service desk.
• Participate in incident response and escalation coverage, including after-hours support as needed.

• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or equivalent practical experience.
• 5+ years of experience in IAM operations or systems/security engineering, including hands-on JML lifecycle management.
• Hands-on experience administering Microsoft Entra ID, including Conditional Access, PIM, and Entra ID Governance.
• Experience operating an enterprise Identity Governance and Administration (IGA) platform, preferably SailPoint ISC or IdentityNow, including troubleshooting failed provisioning.
• Strong PowerShell and Microsoft Graph Scripting skills.
• Working knowledge of SAML, OAuth 2.0, OpenID Connect (OIDC), and SCIM.
• Experience with hybrid identity environments, including Active Directory and Entra Connect or Cloud Sync.
• Experience working in an ITSM environment, such as ServiceNow, and managing requests against defined SLAs., * Python Scripting and REST API integration experience.
• Certifications such as SC-300, SailPoint ISC, AZ-500, Security+, or CISSP.
• Experience with ITSM-integrated automation, low-code tools, Terraform, or Bicep.
• Experience with HRIS-driven provisioning, such as Workday, and audit/compliance processes.
• Familiarity with Privileged Access Management (PAM) tools such as BeyondTrust, ITDR, or SIEM/SOAR integrations.
• Retail or E-commerce industry experience.

Work Arrangement

• Hybrid schedule: 4 days onsite and 1 day remote per week in Seattle, WA.
• Full-time contract assignment with a possibility of extension and conversion.
• MacBook Pro provided.
• Overtime is not required.