IAM Principal Engineer

Deep identity architecture across systems access management, PAM, and IGA/governance. Hands-on configuration and implementation experience is required, not strategy or advisory alone: connector development, policy and workflow design, role modelling, and certification campaign build-out, not only architecture diagrams and roadmaps.

Direct, hands-on tool experience across leading IGA and PAM platforms. Implementation and administration experience, not evaluation-level familiarity. PAM: hands-on work with one or more of CyberArk, Beyond Trust, or Delinea, including session management, credential vaulting, and privileged elevation workflows. IGA: hands-on work with one or more of SailPoint, Saviynt, or ServiceNow Identity Governance, including connector development, provisioning/deprovisioning logic, and role mining. Experience migrating between major IGA platforms (e.g., SailPoint to ServiceNow, or similar transitions) is a strong plus ideally someone who has personally led or executed a live platform transition, including target-state design, data/configuration migration, and governance framework rebuild, not simply evaluated the platforms. Strong Active Directory fluency with hands-on consolidation experience. Comfortable working closely with AD without owning it: forest/trust configuration, GPO and schema work, hybrid sync (Entra Connect) troubleshooting, and object migration tooling (e.g., ADMT/Quest-class) through an actual tenant or directory consolidation project, not just conceptual familiarity with AD structure. Proven, hands-on transformation experience. Design and implementation of target-state identity architecture in a post-merger or multi-entity environment: directory and tenant integration, platform consolidation (merging multiple IGA/PAM tools into one), and the execution work that follows the roadmap, not only the roadmap itself. Working familiarity with the newer tooling landscape, including non-human identity and AI agent governance. Hands-on exposure to service account/NHI lifecycle management (naming standards, reconciliation, automated credential rotation) is a plus; awareness of emerging workload identity and AI-agent authorization patterns (OIDC/SPIFFE-style federation, just-in-time credentialing) is highly valued.