IAM Engineer I, II, III, or Senior

Tri-State Generation and Transmission Association•Westminster, CO

About The Position

The IAM Engineer engineers, operates, and continuously improves Tri-State’s identity and access management capabilities. The position supports the full identity lifecycle for employees, contractors, and non-human identities, including service accounts, across on-premises and cloud environments. Core areas include directory services, identity governance and administration (IGA) and access certification, single sign-on (SSO), multifactor authentication (MFA) and conditional access, privileged access management (PAM) including just-in-time elevation, and public key infrastructure (PKI) and certificate services. The role partners with Human Resources, application owners, infrastructure, cybersecurity, and compliance teams to enforce least privilege, automate identity processes, support regulatory and audit requirements, and provide secure, reliable access to business and operational systems. At the Senior level, the engineer owns complex, cross-functional, high-risk IAM work; defines IAM architecture, standards, and patterns; and mentors and develops IAM Engineers I through III. The position is available at one of four grades: IAM Engineer I (grade 7), IAM Engineer II (grade 8), IAM Engineer III (grade 9), or Senior IAM Engineer (grade 10). The grade is based on the selected candidate’s qualifications and experience and Tri-State’s business needs at the time of hire. Candidates with less experience may be hired at the I, II, or III level. The position requires willingness to travel as needed (approximately 15%), a valid driver’s license, and willingness to perform assigned on-call duty. The ability to work overtime at any time of day or week is considered an essential function because Tri-State must provide continuous, reliable electric service. Before access to NERC CIP-protected systems and information, the employee must successfully complete and maintain a NERC CIP personnel risk assessment and required training.

Requirements

Bachelor’s degree in cybersecurity, computer science, information technology, information security, information assurance, or a related field, or equivalent work experience.
For the Senior level, eight or more years of experience in IAM engineering or a related field.
Expert-level experience designing, implementing, and operating enterprise IAM solutions across IGA, directory services, SSO/federation, MFA and conditional access, PAM, and PKI/certificate services.
Demonstrated experience defining IAM architecture, technical standards, and multi-year roadmaps.
Expert knowledge of hybrid identity architectures and identity protocols and standards such as SAML, OAuth 2.0, OpenID Connect, SCIM, Kerberos, and LDAP.
Experience leading complex, cross-functional IAM projects and vendor engagements from requirements through implementation.
Demonstrated experience mentoring and developing other engineers.
Experience designing controls and leading IAM’s role in audits and regulatory compliance in a regulated environment.
Advanced proficiency in scripting, automation, and API integration, such as PowerShell, Python, and REST APIs.
Strong written and verbal communication skills, including presenting risks and recommendations to IT leadership.
Experience in fast-paced environments and ability to manage workload during stress or escalated activity.
Willingness to travel as needed, approximately 15% of the time.
Valid driver’s license.
Willingness to work assigned on-call duty.
Ability to successfully complete and maintain a NERC CIP personnel risk assessment and required NERC CIP training before access to NERC CIP-protected systems and information.
Ability to work overtime at any time of day or week, as this is considered an essential function of the job.

Nice To Haves

One or more industry certifications: CISSP, CIAM, CIMP, Microsoft Certified: Identity and Access Administrator Associate (SC-300), or SailPoint IdentityIQ certification.
Experience with SailPoint IdentityIQ or another enterprise IGA platform.
Experience with Microsoft Entra ID, including conditional access, in a hybrid Active Directory environment.
Experience with Oracle Cloud (Fusion) security, Oracle Cloud Infrastructure IAM, or Oracle identity integrations.
Experience with Delinea Secret Server or another PAM solution.
Experience with Microsoft Entra Privileged Identity Management or other just-in-time privileged access solutions.
Experience with certificate lifecycle management platforms and certificate automation such as ACME, SCEP/NDES, or EST; Microsoft Active Directory Certificate Services; and hardware security modules.
Experience using AI-assisted tools to automate IAM engineering, scripting, and documentation in accordance with company security and data protection guidelines, and familiarity with securing access for AI applications and agents.
Experience with Sarbanes-Oxley and NERC CIP compliance.
Experience working in the utility or energy sector.
MS, MBA, or related advanced degree.

Responsibilities

Own complex, cross-functional, and high-risk IAM work end-to-end, defining the approach when one does not exist.
Engineer, configure, and troubleshoot IAM platforms, particularly for complex or high-risk changes.
Define and maintain IAM architecture, technical standards, design patterns, and runbooks across directory services, IGA, SSO, MFA, PAM, and PKI.
Develop and drive the IAM technical roadmap with the Cybersecurity Risk Manager, including platform modernization, identity source consolidation, and automation of identity lifecycle processes.
Define the privileged access strategy, including just-in-time elevation, separation of administrative accounts, and elimination of standing privilege.
Define security role architecture and access governance standards for enterprise SaaS and ERP applications, including role design, segregation of duties, and controls for privileged, support, and impersonation access.
Lead enterprise identity architecture design across hybrid on-premises and cloud environments, authoritative identity sources, and integration patterns for business and operational systems.
Define Active Directory and hybrid identity security architecture, including administrative tiering and domain controller and Group Policy security baselines, and role-based access models for cloud platforms.
Serve as senior technical authority and final escalation point for IAM issues, and lead technical responses to identity-related incidents.
Set and review the technical quality of IAM configurations, scripts, integrations, and documentation produced by the team.
Mentor and develop IAM Engineers I through III through coaching, design and code reviews, cross-training, and stretch assignments.
Evaluate IAM products and vendors; define requirements; lead technical evaluations, proofs of concept, and RFP reviews; and provide technical input on vendor statements of work.
Assess IAM-related risks and control gaps, recommend and drive remediation, and present findings and solutions to IT leadership.
Lead IAM’s technical role in internal and external audits and regulatory compliance activities, designing sustainable and auditable controls.
Partner with application owners, Human Resources, infrastructure, operational technology, and business leaders to define access requirements and IAM service boundaries, and independently lead working sessions with senior leadership.
Identify gaps in IAM processes, tooling, and capabilities and drive improvements to make IAM services more automated, reliable, and scalable.
Ensure IAM disaster recovery, redundancy, and resilience plans are designed, tested, and maintained.
Comply with company policies and procedures and maintain knowledge of regulations, laws, standards, and best practices applicable to the functional area.

Benefits

Medical insurance
Dental insurance
Vision insurance
Health Savings Account (HSA)
Flexible Spending Accounts (FSA)
Tuition reimbursement
Flexible work schedules, including compressed work week and telecommuting opportunities to work remotely up to 40%
Life insurance
401(k)
Long-term disability
Short-term disability
Employee Assistance Program (EAP)
Paid leave benefits