Identity & Access Management (IAM) Engineer

Infrastructure & Directory Services|Healthcare Environment|Full-Time

Position Summary

We are seeking an IAM Engineer to own identity infrastructure and access lifecycle operations across the enterprise. This role is focused on directory services, authentication, and identity governance at the platform level — Active Directory, Microsoft Entra ID, SSO, MFA, and automated provisioning. EHR application security (Epic templates, security classes, user profiles) is handled by a separate clinical applications team; this role supports that team upstream by ensuring accurate, timely identity data and account lifecycle events but does not perform EHR provisioning.

Key Responsibilities

• Administer on-prem Active Directory and Microsoft Entra ID: user and group lifecycle, OU structure, GPOs, hybrid sync (Entra Connect), and conditional access policies.
• Execute and automate joiner/mover/leaver processes driven by the HR system of record, ensuring same-day deprovisioning of departed workforce members across AD, M365, VPN, and downstream systems.
• Configure and maintain SSO integrations (SAML 2.0, OIDC) for enterprise and third-party applications; onboard new applications to the identity platform.
• Deploy and support multifactor authentication and passwordless initiatives across employed staff, credentialed providers, contractors, and students.
• Support badge-tap / fast user switching for clinical workstations (e.g., Imprivata OneSign) in coordination with desktop engineering.
• Maintain role-based access models at the directory and group level; remediate access creep and orphaned or stale accounts.
• Run periodic access certification campaigns; produce evidence for HIPAA, HITRUST, SOC 2, and internal audit requests.
• Administer privileged access management for admin and service accounts, including vaulting, rotation, and session monitoring.
• Manage non-employee identity: vendors, travelers, locum tenens providers, students, and affiliate users outside the HR feed.
• Monitor and investigate identity-related security events; support incident response and inappropriate-access investigations with Security and Privacy/Compliance.
• Document standards, runbooks, and workflows; contribute to the IAM roadmap and automation backlog.
  
  

Requirements

• 3–5+ years in identity and access management or systems administration with a heavy identity focus.
• Deep hands-on expertise with Active Directory and Entra ID in a hybrid environment.
• Working knowledge of SAML, OIDC/OAuth 2.0, SCIM, LDAP, and Kerberos.
• Experience deploying MFA and conditional access at enterprise scale.
• PowerShell scripting for AD/Entra automation and reporting.
• Experience supporting audits and access reviews in a regulated environment.
• Understanding of least-privilege and HIPAA minimum necessary principles.
  
  

Preferred Qualifications

• Experience in a hospital or health system IT environment.
• IGA platform experience (SailPoint, Saviynt, Okta Identity Governance, or similar).
• PAM tooling (CyberArk, Delinea).
• Imprivata OneSign or comparable clinical SSO.
• HR-to-identity integration experience (Workday, UKG, or Oracle HCM feeds).
• Certifications: SC-300 (Microsoft Identity and Access Administrator), Security+, CISSP, or CIDPRO.
  
  

What This Role Is Not

This position does not include Epic or other EHR application security build. Candidates will not manage Epic security classes, templates, or user records — that function is owned by the clinical applications team.

Work Environment

Hybrid/on-site per organizational policy; participation in an on-call rotation for identity-impacting incidents (account lockouts affecting clinical operations, termination escalations).