Senior IAM Engineer to support IAM service transition privileged access transformation and identity security improvements across Entra ID Active Directory CyberArk and ServiceNow The role will drive operational handover strengthen access controls and improve governance across both human and nonhuman identities Capable of critical thinking constructively challenging ideas and working independently to a high standard
Key Responsibilities
- IAM Service Transition Operations
- Support handover of IAM BAU operations into a centralized IAM function
- Define IAM service scope operating model and RACI across support teams
- Drive transition planning resource onboarding and knowledge transfer
- Createupdate SOPs process documentation and operational runbooks
- Configure and optimize ServiceNow groups workflows and ticket routing
- Define and track IAM operational metrics KPIs and reporting
- Privileged Access Management Entra PIM
- Implement JustinTime JIT privileged access using Entra PIM
- Migrate standing access to eligible rolebased access via groups
- Configure approval workflows and Tierbased access controls incl Tier 0
- Implement and manage breakglass accounts with monitoring and controls
- Support access recertification and removal of overpermissioned access
- Define and manage Entraonly privileged account model and lifecycle
- Build ServiceNow request workflows for privileged access requests
- Conditional Access Transformation
- Assess and baseline existing Conditional Access policies and risks
- Redesign into a secure simplified and governed CA model
- Enforce controls including
- oMFA phishingresistant
- ocompliant hybrid joined devices
- oriskbased access controls
- Rationalise exceptions exclusions and service account access
- Support testing phased rollout and governance model implementation
- Identity Security Hygiene
- Remediate weak AD passwords user service accounts
- Implement automated user notification and forced reset mechanisms
- Support nonproduction password risk remediation
- Improve controls to prevent weak passwords going forward
- CyberArk PAM Enhancements
- Strengthen CyberArk policies and privileged session controls
- Prevent direct access bypass of vaulted credentials
- Enhance monitoring and ing for privileged access activity
- Perform account discovery and improve vaulting coverage
- Clean up orphaned invalid and leaverrelated accounts and safes
- Implement processes for ongoing CyberArk hygiene and lifecycle management
- Service Accounts NonHuman Identities NHI
- Review and secure AD service accounts remove unnecessary interactive login
- Assess and govern NHI landscape gMSA certificates secrets etc
- Improve credential storage ownership and lifecycle controls
- Strengthen governance of
- oService principals
- oManaged identities
- oApplication registrations
- Reduce dependency on shared secrets and unmanaged credentials
- Emerging Identity Areas AI Workload Identities
- Assess AI agents and automation workflows for identity risks
- Review access models delegated permissions and data exposure
- Recommend controls for secure and governed agentic access
Required Skills
- Strong handson experience in IAM PAM engineering
- Expertise in
- oMicrosoft Entra ID Azure AD
- oPIM Privileged Identity Management
- oConditional Access
- oActive Directory AD
- Experience with CyberArk or equivalent PAM tools
- Experience working with ServiceNow ITSM workflows request management
- Good understanding of
- JIT access least privilege
- Tiered admin model Tier 012
- Identity governance access reviews
- Service accounts nonhuman identities
Good to Have
- Experience in IAM service transition setup
- Exposure to audit compliance and recertification processes
- Knowledge of OAuth certificates workload identity security
- Relevant certifications SC300 CyberArk CISSP etc
Experience
- 6-10 years in IAM Cyber Security
- Strong handson implementation experience required
- IAM IGA Operations Analyst related activities
- 1Perform routine PowerShell based operational scripts for standard reporting data extraction and repeatable IAM housekeeping tasks as per approved runbooks
- 2Execute identity hygiene activities such as user group application and service principal cleanup based on predefined procedures and approval
- 3Support orphaned account identification and remediation activities by running standard reports and executing approved corrective actions
- 4Assist with removal or remediation of legacy authentication methods by executing predefined changes and remediation steps approved by IAM engineering or security team
- 5Provide operational support for SSO MFA and federation platforms including incident handling service requests monitoring and routine maintenance
- 6Implement pre approved authentication and access control policies i
Skills
Mandatory Skills : CYBERARK, IDAM - Microsoft Entra ID, IDAM -Microsoft Azure PIM, PAM
