Identity & Access Management (IAM) Engineer

Identity
& Access Management (IAM) Engineer

Infrastructure
& Directory Services | Healthcare Environment | Full-Time

Position
Summary

We are
seeking an IAM Engineer to own identity infrastructure and access lifecycle
operations across the enterprise. This role is focused on directory services,
authentication, and identity governance at the platform level — Active
Directory, Microsoft Entra ID, SSO, MFA, and automated provisioning. EHR
application security (Epic templates, security classes, user profiles) is
handled by a separate clinical applications team; this role supports that team
upstream by ensuring accurate, timely identity data and account lifecycle
events but does not perform EHR provisioning.

Key
Responsibilities

• Administer on-prem Active Directory and
Microsoft Entra ID: user and group lifecycle, OU structure, GPOs, hybrid sync
(Entra Connect), and conditional access policies.

• Execute and automate joiner/mover/leaver
processes driven by the HR system of record, ensuring same-day deprovisioning
of departed workforce members across AD, M365, VPN, and downstream systems.

• Configure and maintain SSO integrations (SAML
2.0, OIDC) for enterprise and third-party applications; onboard new
applications to the identity platform.

• Deploy and support multifactor authentication
and passwordless initiatives across employed staff, credentialed providers,
contractors, and students.

• Support badge-tap / fast user switching for
clinical workstations (e.g., Imprivata OneSign) in coordination with desktop
engineering.

• Maintain role-based access models at the
directory and group level; remediate access creep and orphaned or stale
accounts.

• Run periodic access certification campaigns;
produce evidence for HIPAA, HITRUST, SOC 2, and internal audit requests.

• Administer privileged access management for
admin and service accounts, including vaulting, rotation, and session
monitoring.

• Manage non-employee identity: vendors,
travelers, locum tenens providers, students, and affiliate users outside the HR
feed.

• Monitor and investigate identity-related
security events; support incident response and inappropriate-access
investigations with Security and Privacy/Compliance.

• Document standards, runbooks, and workflows;
contribute to the IAM roadmap and automation backlog.

Requirements

• 3–5+ years in identity and access management
or systems administration with a heavy identity focus.

• Deep hands-on expertise with Active Directory
and Entra ID in a hybrid environment.

• Working knowledge of SAML, OIDC/OAuth 2.0,
SCIM, LDAP, and Kerberos.

• Experience deploying MFA and conditional
access at enterprise scale.

• PowerShell scripting for AD/Entra automation
and reporting.

• Experience supporting audits and access
reviews in a regulated environment.

• Understanding of least-privilege and HIPAA
“minimum necessary” principles.

Preferred
Qualifications

• Experience in a hospital or health system IT
environment.

• IGA platform experience (SailPoint, Saviynt,
Okta Identity Governance, or similar).

• PAM tooling (CyberArk, Delinea).

• Imprivata OneSign or comparable clinical SSO.

• HR-to-identity integration experience
(Workday, UKG, or Oracle HCM feeds).

• Certifications: SC-300 (Microsoft Identity and
Access Administrator), Security+, CISSP, or CIDPRO.

What
This Role Is Not
This position
does not include Epic or other EHR application security build. Candidates will
not manage Epic security classes, templates, or user records — that function is
owned by the clinical applications team.

Work
Environment
Hybrid/on-site
per organizational policy; participation in an on-call rotation for
identity-impacting incidents (account lockouts affecting clinical operations,
termination escalations).