IAM Engineer III, Identity & Access Management

Chewy • Plantation, FL

1d • $118,500 - $189,500

About The Position

Chewy’s Identity and Access Management (IAM) team ensures people, services, and AI agents have appropriate access throughout their lifecycle. The IAM Engineer III is a senior individual-contributor role responsible for setting technical direction for identity platforms, primarily SailPoint Identity Security Cloud (ISC) and, in partnership with specialists, Okta. This role leads major initiatives that reduce manual work while maintaining strong controls and audit-ready evidence. It also mentors IAM Engineer I and II staff, leads design reviews, and helps shape governance for non-human identities, including AI agents.

In the first year, the engineer will modernize the joiner experience so accounts and appropriate access are ready on an employee’s start date, automate birthright access through rule-based roles, and strengthen leaver and contractor lifecycle controls. The role will onboard and operate SailPoint Machine Identity Security (MIS) and Data Access Security (DAS), extend governance to service accounts, machine identities, and sensitive data access, and help move application access away from legacy directory groups toward modern requestable patterns. The engineer will build safe automation, including AI-assisted automation where useful, retaining human approval where appropriate and clear evidence for audits.

The role owns IAM projects end to end, from defining baselines and designing solutions through implementation, rollout, and measurement. It turns recurring tickets, incidents, and review findings into lasting automation or self-service, leads root-cause analysis for serious failures, prioritizes technical debt, and participates in the on-call rotation for critical identity services.

Nice To Haves

• SailPoint ISC certification, such as ISC Engineer, and/or Okta Certified Professional or Administrator certification.
• Experience building AI-assisted automation or agent-based workflows with human approval steps and audit-ready evidence.
• Experience governing non-human identities, including service accounts, workload identities, or AI agent credentials.
• Experience with HR-driven lifecycle management, Workday as the source of truth, and birthright role design at scale.
• Experience integrating identity with service management, such as ServiceNow catalog and request flows.
• Background in audit and control evidence, including certifications, separation of duties, and least privilege.

Responsibilities

• Own IAM projects end to end: define the problem and baseline metrics, design and lead the solution, roll it out, and demonstrate results.
• Identify recurring tickets, incidents, and review findings and eliminate them through automation or self-service.
• Set technical direction and design SailPoint ISC solutions for lifecycle management, provisioning, correlation, connectors, transforms, workflows, and roles.
• Apply safe change practices, including testing, staged rollouts, and rollback planning.
• Partner with Okta experts on application access, lifecycle, and provisioning patterns.
• Own and prioritize the technical debt list for the role’s area.
• Lead root-cause analysis of serious failures and implement lasting fixes.
• Mentor IAM Engineer I and II staff through design reviews and pairing.
• Govern non-human identities, including service accounts, workloads, and AI agents.
• Participate in the on-call rotation for critical identity services.
• Modernize the joiner experience and automate birthright access at scale.
• Strengthen leaver and contractor lifecycle controls so access ends when employment or a contract ends, with proof.
• Onboard and operate SailPoint Machine Identity Security and Data Access Security.
• Help move application access off legacy directory groups to modern, requestable patterns.
• Build safe automation, using AI where helpful, with human approval where needed and audit-ready evidence.

Benefits

• 401(k)
• New-hire and annual equity grant; C08+ positions may also be eligible for an annual bonus.
• Medical/Rx, vision, dental, life, disability, hospital indemnity, critical illness, and accident insurance.
• Parental leave, family services benefits, and backup dependent care.
• Flexible spending accounts, telemedicine, and employee assistance program.
• Pet adoption reimbursement and discounts, including 10% off pet insurance and 20% off at Chewy.com.
• Unlimited PTO for exempt salary team members, subject to manager approval.
• Six paid holidays per year.
• Paid sick and family leave may be available in compliance with applicable state and local regulations.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed