The RoleThe IT IAM Engineer acts as a business enabler, proactively identifying and building solutions that help the company scale securely. The role owns the day-to-day administration of Lumistry's identity, access, and endpoint infrastructure and serves as the technical escalation point above our managed service provider for IT support. This is a role for someone who is comfortable working autonomously and taking ownership of their work, with support from the team. We are looking for a candidate who enjoys pragmatic optimization: automate the repetitive work and remediate what matters. The role reports to the Senior Director of IT & Information Security.
Responsibilities- Administer the corporate identity provider: SSO configuration, application integrations, directory hygiene, and authentication policy
- Build and maintain SCIM provisioning and deprovisioning so that joining, moving, and leaving the company drives access automatically from the HR system of record
- Develop zero-touch employee lifecycle from initial provisioning through teardown in disparate systems.
- Design and operate privilege escalation workflows so elevated access is requested, approved, time-bound, and logged rather than standing
- Manage the lifecycle of service, shared, and machine accounts, including ownership assignment, credential vaulting, and rotation
- Administer the productivity and collaboration suites (Google Workspace, Microsoft 365), including organizational units, delegation, security settings, and license hygiene
- Execute identity consolidation across legacy product domains, working toward a single directory of record
- Manage business request intake and routing so that requests for access, software, and purchases are approved by the appropriate owners before fulfillment
- Conduct recurring user-access reviews and SSO hygiene checks across the SaaS application estate, producing audit-ready evidence
- Manage software and hardware assets, including inventory tracking, procurement support, and administration of the macOS and Windows fleet through MDM
- Maintain endpoint security by enforcing patching, triaging endpoint security alerts and vulnerabilities, and driving remediation to completion
- Serve as the escalation point for the outsourced helpdesk, resolving escalated tickets and identifying opportunities to automate recurring requests
- Automate repetitive tasks by integrating and scripting across the IT and security toolchain to scale the team's impact as the company grows
- Support SOC 2 and enterprise customer security reviews with access evidence, controls, and documentation
- Other duties as assigned
Qualifications- 5+ years of hands-on IT or identity experience in a production environment
- Direct experience configuring an identity provider and SSO integrations (SAML/OIDC)
- Experience building SCIM provisioning and deprovisioning against a real application estate
- Experience with Mobile Device Management for macOS and Windows
- Practical scripting ability (Python, PowerShell, or similar) and comfort working with application and directory APIs
- Detail and process-oriented mindset with the willingness to be a generalist and dig into things you have not done before
- Excellent written communication and an inclination to document your work
- Ability to operate semi-autonomously, sorting immediate priorities out of the shifting needs of a growing company
Preferred- Experience in a regulated space such as SOC 2, HIPAA, or PCI compliance environments
- Experience with identity workflow and automation platforms
- Experience consolidating identity across acquired or legacy products
- Experience coordinating with a managed service provider
- Prior experience at a SaaS company or startup
- Experience in secure systems for healthcare or financial industries
CompensationThe salary range for this role is $100,000-120,000, commensurate with experience.
Work LocationThis is a remote position for candidates based out of the U.S. Applicants must currently reside in and be legally authorized to work in the United States. We are currently unable to provide visa sponsorship or relocation assistance for this role.
