IAM Engineer III, Identity & Access Management

Chewy•Minneapolis, MN

2d•$118,500 - $189,500

About The Position

Chewy’s IAM team connects people, services, and AI agents to appropriate access throughout their lifecycle. The IAM Engineer III is a senior individual-contributor role that sets technical direction for identity platforms, primarily SailPoint Identity Security Cloud (ISC) alongside Okta, and leads projects that eliminate manual work. Success is measured by reducing manual steps and request types and shortening cycle times while maintaining strong controls and audit evidence. The role mentors IAM Engineer I and II staff, leads design reviews, and helps shape governance for non-human identities, including AI agents. In the first year, the engineer will modernize the joiner experience so access is ready on the correct start date; automate birthright licenses and access through rules and roles; strengthen leaver and contractor lifecycle controls; onboard and operate SailPoint Machine Identity Security (MIS) and Data Access Security (DAS); move application access away from legacy directory groups toward modern requestable patterns; and build safe automation, including AI-supported automation where useful, with human approvals and audit evidence where needed.

Nice To Haves

SailPoint ISC certification, such as ISC Engineer, and/or Okta Certified Professional or Administrator certification.
Experience building AI-assisted automation or agent-based workflows with human approval steps and audit-ready evidence.
Experience governing non-human identities, such as service accounts, workload identities, or AI agent credentials.
Experience with HR-driven lifecycle management, Workday as the source of truth, and birthright role design at scale.
Experience integrating identity with service management, including ServiceNow catalog and request flows.
Background in audit and control evidence, including certifications, separation of duties, and least privilege.

Responsibilities

Own IAM projects end to end, from defining the problem and baseline metrics through solution design, implementation, rollout, and demonstrating results.
Identify recurring tickets, incidents, and review findings and eliminate repeat work through automation or self-service.
Set technical direction and design SailPoint ISC solutions for lifecycle management, provisioning, correlation, connectors, transforms, workflows, and roles, using testing, staged rollout, and rollback practices.
Partner with Okta experts on application access, lifecycle, and provisioning patterns.
Prioritize and reduce technical debt in the assigned area.
Lead root-cause analysis of serious failures and implement lasting fixes.
Mentor IAM Engineer I and II staff through design reviews and pairing.
Govern non-human identities, including service accounts, workloads, and AI agents.
Participate in the on-call rotation for critical identity services.
Modernize joiner, leaver, and contractor access lifecycles, including timely provisioning and deprovisioning with evidence.
Automate birthright access and licenses using rules-based roles that respond to employee lifecycle changes.
Onboard and run SailPoint Machine Identity Security and Data Access Security.
Help consolidate application access onto modern requestable patterns and move it away from legacy directory groups.
Build automation, including AI-assisted automation where appropriate, while retaining human approval where needed and producing clear audit evidence.

Benefits

401(k)
New-hire and annual equity grants
Potential annual bonus for C08+ positions
Medical/Rx insurance
Vision insurance
Dental insurance
Life insurance
Disability insurance
Hospital indemnity insurance
Critical illness insurance
Accident insurance
Parental leave
Family services benefits
Backup dependent care
Flexible spending accounts
Telemedicine
Pet adoption reimbursement
Employee assistance program
Employee discounts, including 10% off pet insurance and 20% off at Chewy.com
Unlimited PTO for exempt salary team members, subject to manager approval
Six paid holidays per year
Potential paid sick and family leave in accordance with applicable state and local regulations