Cybersecurity Engineer

Visa•Austin, TX

4d•$112,100 - $173,400•Hybrid

About The Position

The Cybersecurity Analyst – IAM supports identity and access management controls across the Pismo platform, helping ensure compliance with Visa Corporate Identity & Access Technical Security Requirements. Working with senior IAM engineers, the analyst operates and continuously improves access controls for human and non-human identities across AWS and hybrid environments. Work includes access reviews, permission analysis, privileged-access monitoring, identity-inventory maintenance, and automation of recurring tasks. The role partners with Cloud Security, Platform Engineering, API, DevSecOps, and GRC teams to apply least-privilege and zero-trust practices in a regulated, multi-tenant payments environment. The role also supports governance of AI-enabled identity use cases by tracking identities, credentials, and permissions used by AI systems, agents, and automation, and checking them against Internal AI Governance standards and Corporate IAM requirements. This is a hybrid position requiring at least three days in the office; the Hiring Manager will confirm which days. The position is performed in an office setting and requires 5–10% travel. Work hours vary according to department needs.

Requirements

At least 2 years of relevant work experience and a Bachelor's degree, or at least 5 years of relevant work experience. Master's graduates must have at least 2 years of relevant work experience to qualify at the Analyst (I5) level.
At least 2 years of hands-on experience in identity and access management, cloud security, or security operations.
Experience administering or operating an enterprise identity provider, including SSO (SAML/OIDC), MFA, groups and group rules, and lifecycle provisioning (SCIM).
Working knowledge of AWS IAM roles, policies and trust policies, IAM Identity Center permission sets, and the ability to read and evaluate policy documents.
Understanding of RBAC and ABAC, least privilege, separation of duties, and just-in-time and break-glass access.
Experience running access reviews or certifications and supporting joiner/mover/leaver processes.
Scripting experience in Python or an equivalent language, including calls to REST APIs and SDKs.
Ability to read and change Terraform and work with Git and pull requests.
Clear written communication, including documentation and audit evidence.

Nice To Haves

At least 3 years of work experience with a Bachelor's degree, or more than 2 years of work experience with an advanced degree such as a Master's, MBA, JD, or MD.
Experience with Okta (preferred) or Microsoft Entra ID.
Exposure to Azure or GCP IAM.
Familiarity with Kubernetes RBAC and service accounts.
Knowledge of access-control requirements in PCI DSS (Requirements 7 and 8), ISO 27001, and NIST SP 800-53 (AC family).
Relevant certifications, such as Okta Certified Administrator, Microsoft SC-300, AWS Certified Solutions Architect – Associate or Security – Specialty, or CompTIA Security+.

Responsibilities

Run periodic user access reviews and recertifications for Pismo applications and components, and collect, reconcile, and retain evidence.
Monitor joiner, mover, and leaver events and confirm that access is granted, changed, and removed on time across the identity provider, cloud accounts, source control, and Kubernetes clusters.
Review access requests and permission changes, including group, role, and permission-set changes submitted as code, for least privilege and separation of duties.
Analyze cloud and platform permissions to identify excessive, unused, or orphaned access, and track remediation with the owning teams.
Monitor privileged, just-in-time, and break-glass access; investigate deviations and report exceptions.
Maintain role and entitlement catalogs and application access matrices.
Maintain an inventory of service accounts, workload roles, API credentials, and AI agent identities, including their owners, purposes, permissions, and application mappings.
Check that non-human identities meet standards for ownership, scope, credential rotation, and expiry.
Write and maintain scripts and automations using identity and cloud APIs and SDKs to extract access data, produce reports, and automate recurring checks.
Make changes to existing Terraform-based AWS automation IAM definitions through the standard review process.
Support internal and external audits and Visa security assessments, including PCI DSS, ISO 27001, and SOC 2, by providing access-control evidence and supporting control testing.
Track IAM findings and exceptions through closure, and report status and metrics to IAM leadership.
Write and maintain runbooks, procedures, and documentation for IAM processes.