Identity & Access Management Engineer

Job Overview

Pretium Enterprise Services is seeking an Identity and Access Management Engineer Lead to design, build and operate identity security capabilities across the operating companies PES supports. This is a hands-on individual contributor role with no direct reports. You will own technical delivery of the identity roadmap, with an initial focus on strengthening existing access controls and implementing Identity Governance and Administration (IGA). You will personally configure platforms, develop integrations and automation, troubleshoot production issues, and establish reusable standards across Microsoft, AWS and business applications.

This role is hybrid three days a week in our office located in Scottsdale, Arizona (preferred location). Other locations that will considered: Dallas, Texas; Charlotte, North Carolina and California.

What You Will Do

• Assess identity environments across operating companies, prioritize risks and integration dependencies, and deliver a phased IAM roadmap with the Director of Cybersecurity.

• Own hands-on IGA implementation and ongoing operations, including platform configuration, application onboarding, connectors, reconciliation, access requests and certification campaigns.

• Integrate HR systems, directories and applications to automate joiner, mover and leaver processes for employees and contractors. Resolve identity-data quality issues and verify access removal across connected systems.

• Engineer Microsoft Entra ID and hybrid Active Directory controls, including SSO, federation, MFA, Conditional Access and directory synchronization; secure guest and cross-tenant access where required.

• Design and implement workforce access across AWS accounts and Azure environments, including federation, AWS IAM Identity Center permission sets and privileged role assignments, partnering with cloud engineering on resource-level permissions.

• Establish privileged-access controls, including time-limited elevation, approvals, administrative account separation and tested emergency access. Reduce unnecessary standing privileges and remediate orphaned or excessive access.

• Work with HR, application and business owners to define role-based access, birthright rules, entitlement ownership and segregation of duties. Translate approved decisions into enforceable workflows and access reviews.

• Build and troubleshoot application integrations using SAML, OpenID Connect, OAuth and SCIM. Develop API-based connectors and automation where native integrations do not meet requirements.

• Establish ownership, access-review and credential-lifecycle standards for service accounts, application identities, RPA bots and AI agents; partner with cloud and AI engineers on implementation.

• Own identity service reliability, including provisioning-failure monitoring, root-cause resolution, change testing, rollback and recovery procedures. Partner with security operations on identity logging and incident containment.

• Provide technical direction to implementation partners, validate deliverables, and ensure documentation and knowledge transfer. Mentor and cross-train engineers to provide operational backup without direct management responsibility.

• Track provisioning reliability, access-removal timeliness, privileged-access exposure and review completion. Produce audit evidence and drive remediation with application and OpCo owners.

Who We Are Looking For

• Senior-level IAM engineering experience owning enterprise identity solutions from design through production support, with the ability to independently assess problems, implement controls and verify outcomes.
• Bachelor's Degree in Computer Science, Cybersecurity, Information Securtiy, Computer Engineering, Software Engineering, or Information Technology
• Hands-on delivery of an enterprise IGA implementation through go-live and operational support, including connectors, lifecycle workflows, reconciliation and access reviews.

• Strong Microsoft Entra ID and Active Directory engineering skills, including federation, Conditional Access, privileged identity management and hybrid identity troubleshooting.

• Production experience with AWS workforce federation, IAM Identity Center and Azure access controls. Ability to assess effective access across directory roles, application entitlements and cloud permissions.

• Ability to implement and troubleshoot SAML, OpenID Connect, OAuth and SCIM integrations, including authentication, authorization and provisioning failures.

• Strong PowerShell or Python skills and REST API experience, such as Microsoft Graph. Ability to build tested, version-controlled automation with error handling, monitoring and secure credential handling.

• Experience translating business access requirements into maintainable least-privilege controls, privileged-access workflows, role-based access and identity lifecycle processes.

• Ability to explain risk, secure cooperation and drive remediation across independent teams. Strong documentation, troubleshooting and technical mentoring skills.

Preferred Qualifications

Experience in shared-services or multi-tenant environments; Workday or ADP integrations; Linx, SailPoint or Saviynt; dedicated PAM solutions; or access governance for Palantir, Snowflake or Salesforce. Relevant certifications are welcome.

What We Offer

This position offers the opportunity to join a collegial, entrepreneurial firm committed to the personal and professional growth of its team members and to maintaining a positive, encouraging work environment where people enjoy working together. The company offers a comprehensive benefits and perks package, including:

• 401(k) plan with an employer match

• Health, dental, vision and life insurance

• Paid Time Off (PTO)

• 11 firm holidays

• Hybrid office/work from home arrangement

• Annual year-end bonus eligible