Job DescriptionFabletics is looking for a Sr. SailPoint Engineer to join our Identity Governance team's SailPoint Engineering group, working alongside other SailPoint Engineers to administer and evolve the SailPoint Identity Security Cloud / IdentityNow platform - including application onboarding, lifecycle automation, and ongoing improvements to MyAccess. This role will work independently and collaboratively across application integrations, RBAC design, and identity governance initiatives, partnering with IT Operations, Service Desk, HRIS/Workday, Security, and business stakeholders to keep identity processes reliable, auditable, and scalable.
How Do You Fit In?The Sr. SailPoint Engineer is a key contributor to Fabletics' Identity & Access Management program, working as part of a team of SailPoint Engineers to configure, troubleshoot, and improve SailPoint. You'll take on application integration projects (including Workday), contribute to the design and rollout of an org-wide RBAC framework, and help diagnose and repair broken identity workflows - sometimes independently, sometimes in partnership with teammates on larger initiatives. This is a strong fit for someone who already has real SailPoint depth, works well both independently and as part of a collaborative engineering team, and wants meaningful input into how identity is modeled and secured company-wide.
What You Can Bring- 3-5 years of hands-on experience administering a SailPoint IGA platform (Identity Security Cloud/IdentityNow required; IdentityIQ experience a plus), including access certifications, provisioning policies, and identity lifecycle workflows.
- Experience integrating SailPoint with Workday as an authoritative identity source - including HR-driven identity events (hire, transfer, termination, rehire), attribute mapping, and troubleshooting sync/integration failures between the two platforms.
- Experience building and integrating applications/sources into an IGA platform - connector configuration, entitlement mapping, aggregation, and correlation.
- Demonstrated ability to diagnose and fix broken or unreliable workflows - approval routing failures, stuck workflows, provisioning/deprovisioning failures, and aggregation issues - including root-cause analysis, not just one-off patches.
- Working knowledge of Role-Based Access Control (RBAC) theory - role mining, role hierarchies, least-privilege design, separation-of-duties - with the ability to contribute to designing or maturing an RBAC model in a live enterprise environment.
- Solid understanding of IAM concepts: users, groups, roles, entitlements, access requests, approvals, provisioning, deprovisioning, and certifications.
- Experience integrating SailPoint with Active Directory and Azure / Microsoft Entra ID.
- Experience configuring SCIM and REST API integrations, and building workflow automation.
- Ability to work independently on assigned initiatives as well as collaboratively within a team of SailPoint Engineers on larger projects.
- Experience partnering with application owners, auditors, and compliance stakeholders on access reviews.
- Strong communication skills with both technical and non-technical stakeholders.
- Foundational-to-intermediate AI literacy, with experience using generative AI tools to drive productivity in identity operations.
Preferred / Nice-to-Have Skills- Experience with Microsoft Teams workflow-based approvals.
- Familiarity with ITSM tools such as Freshservice, Jira, or Microsoft Planner.
- Experience supporting SOX audits, access reviews, or compliance programs.
- Prior experience mentoring junior engineers or service desk staff on IAM concepts.
What You Will Be DoingRBAC & Access Model Design- Contribute to the design and organization-wide rollout of a Role-Based Access Control model - including role mining/role engineering, defining role hierarchies aligned to job functions, minimizing entitlement sprawl, and enforcing least-privilege and separation-of-duties principles.
- Partner with fellow SailPoint Engineers, application owners, and business stakeholders to translate job functions into governed roles.
Application Integrations & Workflow Reliability- Work independently or with the SailPoint Engineering team on integrating new applications and sources into SailPoint/MyAccess - connector setup, entitlement mapping, aggregation testing, and account correlation.
- Support and troubleshoot the Workday-to-SailPoint integration, ensuring identity lifecycle events (hires, transfers, terminations, rehires) flow accurately and reliably; resolve sync failures and data mismatches.
- Diagnose and repair broken or unreliable workflows across the platform - approval routing failures, stuck approvals, provisioning/deprovisioning errors, and aggregation exceptions.
SailPoint / MyAccess Administration- Configure and maintain applications, sources, access profiles, roles, governance groups, owners, and approvers within SailPoint Identity Security Cloud / IdentityNow (MyAccess), as part of the broader engineering team.
- Monitor SailPoint workflows, source aggregation jobs, and exception queues; support sandbox testing, production validation, and release documentation.
Onboarding, Offboarding & Lifecycle Automation- Contribute to onboarding/offboarding process design for FTEs, retail users, contractors, and rehires, including identity lifecycle state logic and Workday-driven identity changes.
- Support accurate downstream provisioning/deprovisioning to Active Directory, Azure/Entra ID, and connected applications; help improve termination automation and post-termination access cleanup.
- Support retail automation flows including birthright access, group assignments, and promotion/demotion scenarios.
Monitoring, Audits & Certifications- Monitor and remediate uncorrelated, orphaned, and duplicate accounts, stale access, and source mismatches.
- Support SOX-related access reviews, evidence collection, and certification campaigns; help clean up invalid access profiles, missing owners, and inactive approvers.
Documentation & Cross-Functional Collaboration- Maintain documentation, runbooks, and troubleshooting guides for MyAccess processes, integrations, and the RBAC model.
- Collaborate with business users, application owners, HRIS, Security, IT Operations, Service Desk, and Retail IT, along with fellow SailPoint Engineers, to translate access requirements into SailPoint configuration.
Where we are:- This role will be remote, with headquarters located in El Segundo, CA
Compensation & Total Rewards: At Fabletics, we believe work and life should fit together! We continue to build a culture of flexibility, to empower you to do your best and put yourself first. Our Total Rewards program rewards employees for their hard work, supporting their health, well-being, families, and ultimately their life journey. Total Rewards at Fabletics includes:
-Hybrid Work Schedule*
-Discretionary Paid Time Off*
-Summer Fridays*
-Healthcare Plans
-Employee Discounts
-401k
-Annual Bonus Program
-Equity Program*
-And More
*Varied for retail, fulfillment and fully remote roles.
The annual base salary range for this position is from $94,446-$130,000. The range provided includes the base salary that Fabletics expects to pay for the role. Offered base salary will be dependent on factors including the scope and complexity of the role, candidate's related work experience, subject matter expertise and work location.
#LI-JR1
#LI-Fabletics
#LI-Remote
