IAM AI Engineer

Gallagher•Rolling Meadows, IL

About The Position

The Identity and Access Management AI Engineer designs, engineers, and operationalizes AI-enabled identity security capabilities across the enterprise. The role combines IAM engineering with artificial intelligence, machine learning, automation, and analytics to strengthen identity controls, reduce access risk, improve operational efficiency, and detect identity-based threats. It applies AI to access governance, privileged access, authentication risk, identity lifecycle management, entitlement analysis, anomaly detection, and automated decision support, including deployment and operationalization of built-in AI capabilities expected in the next version of Identity Manager. The position partners with IAM, the Corporate AI Team, cyber defense, security architecture, infrastructure, cloud, data science, risk, compliance, and application teams to deliver secure, scalable, and compliant identity solutions. It also advances identity governance and access intelligence; embeds security, privacy, and responsible AI controls; integrates AI capabilities with IAM platforms and enterprise data; and supports threat detection and identity defense.

Requirements

Bachelor’s degree in cybersecurity, computer science, information technology, data science, engineering, or a related field, or equivalent practical experience.
Five or more years of experience in identity and access management, cybersecurity engineering, security architecture, cloud security, or related technology roles.
Hands-on experience with IAM platforms, identity governance, access management, privileged access management, directory services, SSO, MFA, federation, and lifecycle management.
Practical experience applying automation, analytics, AI, machine learning, or data science techniques to security, risk, identity, or operational use cases.
Strong understanding of authentication and authorization protocols, including SAML, OAuth 2.0, OpenID Connect, SCIM, LDAP, Kerberos, and modern API security patterns.
Experience with scripting or software development using Python, PowerShell, JavaScript, Java, C#, Go, or similar languages.
Knowledge of cloud identity and security services across Microsoft Azure, AWS, or Google Cloud Platform.
Experience working with structured and unstructured data, query languages, data pipelines, log analytics, and visualization tools.
Strong analytical, troubleshooting, communication, and stakeholder management skills.

Nice To Haves

Experience with Microsoft Entra ID, Entra ID Governance, Entra Permissions Management, Microsoft Defender, Sentinel, Purview, Azure Key Vault, or related Microsoft security capabilities.
Experience with IGA, PAM, and access management platforms such as SailPoint, Saviynt, CyberArk, One Identity, Okta, Ping Identity, ForgeRock, or similar technologies.
Experience with AI or ML frameworks, large language model platforms, vector databases, graph analytics, feature engineering, model evaluation, or MLOps and LLMOps practices.
Familiarity with identity threat detection and response, user and entity behavior analytics, security orchestration, SIEM, SOAR, and threat hunting.
Knowledge of responsible AI, model risk management, privacy engineering, data protection, and AI governance frameworks.
Experience supporting regulated environments such as financial services, insurance, healthcare, government, or other compliance-driven industries.
Professional certifications such as CISSP, CISM, CCSP, Microsoft Security certifications, Azure certifications, AWS Security Specialty, GIAC, Certified Identity and Access Manager, or AI/security-related certifications.

Responsibilities

Design, build, and support AI-driven IAM capabilities for identity governance, access management, privileged access management, and authentication risk controls.
Develop models, analytics, and automation to identify excessive access, toxic entitlement combinations, segregation of duties conflicts, dormant accounts, orphaned identities, risky privileged access, and abnormal authentication behavior.
Use machine learning, rules-based analytics, and graph-based identity intelligence to detect access anomalies and recommend remediation actions.
Engineer AI-assisted workflows for access request reviews, entitlement certification, role mining, policy recommendations, and identity lifecycle decisions.
Partner with IAM platform owners to integrate AI capabilities into identity governance, access management, PAM, directory, and cloud identity tools.
Lead or support deployment, configuration, governance, and adoption of built-in AI capabilities delivered in the next version of Identity Manager.
Enhance identity governance with automated access insights, risk scoring, peer-group analysis, and entitlement usage analytics.
Support data-driven RBAC, ABAC, policy-based access control, and least-privilege models.
Design and tune access risk models using business criticality, privilege level, account type, data sensitivity, and user behavior to prioritize remediation.
Improve access certification campaigns by reducing reviewer fatigue, identifying low-risk approvals, and surfacing high-risk exceptions.
Develop reporting and dashboards that provide IAM leadership, risk teams, auditors, and application owners with actionable identity risk insights.
Embed security, privacy, and responsible AI principles into IAM AI solutions from design through production operations.
Assess IAM AI use cases for data leakage, prompt injection, model misuse, biased recommendations, excessive automation, and unauthorized access to sensitive identity data.
Implement controls for model access, prompt governance, data minimization, audit logging, approval workflows, and human-in-the-loop decision-making.
Collaborate with legal, privacy, compliance, and risk stakeholders to align IAM AI solutions with policies, regulatory obligations, and industry frameworks.
Work with the Corporate AI Team to align solutions with enterprise AI strategy, approved architecture patterns, model governance, responsible AI standards, and shared platform capabilities.
Document AI decision logic, data sources, assumptions, limitations, and control requirements to support auditability and transparency.
Integrate IAM AI capabilities with enterprise IAM, security, cloud, service management, SIEM, SOAR, and data lake platforms.
Develop secure APIs, scripts, pipelines, and automation patterns for identity lifecycle management, access provisioning and deprovisioning, review, and remediation.
Use infrastructure as code, DevSecOps, and CI/CD practices to deploy reliable, repeatable, and secure IAM AI services.
Partner with data engineering teams to ingest, normalize, protect, and analyze identity, access, authentication, privilege, HR, application, and security event data.
Coordinate AI platform integration, approved model usage, reusable AI services, monitoring, and enterprise AI deployment patterns with the Corporate AI Team.
Ensure solutions are resilient, observable, scalable, and aligned with enterprise architecture standards.
Develop and tune identity threat detection analytics for suspicious authentication, impossible travel, abnormal privilege use, anomalous service account behavior, risky API access, and unusual entitlement changes.
Support cyber defense teams by correlating IAM telemetry with endpoint, network, cloud, application, and threat intelligence data.
Contribute to incident response playbooks for identity compromise, credential misuse, privileged access abuse, and AI-assisted attacks against identity systems.
Evaluate emerging AI-enabled identity threats and recommend improvements to authentication, authorization, governance, and monitoring controls.
Support continuous improvement of zero trust, phishing-resistant authentication, conditional access, privileged access, and identity detection and response capabilities.