IAM Engineer I, II, III, or Senior

Tri-State Generation and Transmission Association, Inc.•Westminster, CO

4d•$82,000 - $143,000•Hybrid

About The Position

The IAM Engineer is responsible for engineering, operating, and continuously improving Tri-State’s identity and access management capabilities. The role supports the full identity lifecycle for employees, contractors, and non-human identities, such as service accounts, across on-premises and cloud environments. Core capabilities include directory services; identity governance and administration (IGA) and access certification; single sign-on (SSO); multifactor authentication (MFA) and conditional access; privileged access management (PAM), including just-in-time elevation; and public key infrastructure (PKI) and certificate services. The position partners with Human Resources, application owners, infrastructure, cybersecurity, and compliance teams to enforce least privilege, automate identity processes, support regulatory and audit requirements, and deliver secure, reliable access to business and operational systems. At the Senior level, the role owns the most complex, cross-functional, and highest-risk IAM work; defines IAM architecture, standards, and patterns; and mentors IAM Engineers I through III. The position will be filled at one of four grades—IAM Engineer I, II, III, or Senior—based on the selected candidate’s qualifications and experience and Tri-State’s business needs. Tri-State is a not-for-profit wholesale power supply cooperative serving member electric distribution cooperatives and public power districts in Colorado, Nebraska, New Mexico, and Wyoming. It delivers power and energy services to nearly one million electricity consumers across approximately 200,000 square miles. The organization is headquartered in Westminster, Colorado, and employs approximately 1,000 people across five states.

Requirements

Bachelor’s degree in cybersecurity, computer science, information technology, information security, information assurance, or a related field, or equivalent work experience.
For the Senior IAM Engineer level, eight or more years of experience in IAM engineering or a related field.
Expert-level experience designing, implementing, and operating enterprise IAM solutions across IGA, directory services, SSO/federation, MFA and conditional access, PAM, and PKI/certificate services.
Demonstrated experience defining IAM architecture, technical standards, and multi-year roadmaps.
Expert knowledge of hybrid identity architectures and identity protocols and standards such as SAML, OAuth 2.0, OpenID Connect, SCIM, Kerberos, and LDAP.
Experience leading complex, cross-functional IAM projects and vendor engagements from requirements through implementation.
Demonstrated experience mentoring and developing other engineers.
Experience designing controls and leading IAM’s role in audits and regulatory compliance in a regulated environment.
Advanced proficiency in scripting, automation, and API integration, such as PowerShell, Python, and REST APIs.
Strong written and verbal communication skills, including presenting risks and recommendations to IT leadership.
Experience working in fast-paced environments and ability to manage workload during stress or escalated activity.
Willingness to travel as needed, approximately 15% of the time.
Valid driver’s license.
Willingness to work on-call duty as assigned.
Ability to successfully complete and maintain a NERC CIP personnel risk assessment and required NERC CIP training before receiving access to protected systems and information.

Nice To Haves

One or more industry certifications, such as CISSP, CIAM, CIMP, Microsoft Certified: Identity and Access Administrator Associate (SC-300), or SailPoint IdentityIQ certification.
Experience with SailPoint IdentityIQ or another enterprise IGA platform.
Experience with Microsoft Entra ID, including conditional access, in a hybrid Active Directory environment.
Experience with Oracle Cloud (Fusion) security, Oracle Cloud Infrastructure IAM, or Oracle identity integrations.
Experience with Delinea Secret Server or another PAM solution.
Experience with Microsoft Entra Privileged Identity Management or other just-in-time privileged access solutions.
Experience with certificate lifecycle management platforms and certificate automation such as ACME, SCEP/NDES, or EST; Microsoft Active Directory Certificate Services; and hardware security modules.
Experience using AI-assisted tools to automate IAM engineering, scripting, and documentation in accordance with company security and data protection guidelines, and familiarity with securing access for AI applications and agents.
Experience with Sarbanes-Oxley and NERC CIP compliance.
Experience working in the utility or energy sector.
An MS, MBA, or related advanced degree.

Responsibilities

Own the most complex, cross-functional, and highest-risk IAM work end-to-end, defining the approach where one does not yet exist.
Engineer, configure, and troubleshoot IAM platforms, particularly for complex or high-risk changes.
Define and maintain IAM architecture, technical standards, design patterns, and runbooks across directory services, IGA, SSO, MFA, PAM, and PKI.
Develop and drive the IAM technical roadmap in partnership with the Cybersecurity Risk Manager, including platform modernization, identity source consolidation, and identity lifecycle automation.
Define privileged access strategy, including just-in-time elevation, separation of administrative accounts, and elimination of standing privilege.
Define security role architecture and access governance standards for enterprise SaaS and ERP applications, including role design, segregation of duties, and controls over privileged, support, and impersonation access.
Lead enterprise identity architecture design across hybrid on-premises and cloud environments, authoritative identity sources, and integrations for business and operational systems.
Define Active Directory and hybrid identity security architecture, including administrative tiering, domain controller and Group Policy security baselines, and role-based access models for cloud platforms.
Serve as the senior technical authority and final escalation point for IAM issues, and lead technical responses to identity-related incidents.
Review the technical quality of IAM configurations, scripts, integrations, and documentation produced by the team.
Mentor and develop IAM Engineers I through III through coaching, design and code reviews, cross-training, and stretch assignments.
Evaluate IAM products and vendors; define requirements; lead technical evaluations, proofs of concept, and RFP reviews; and provide technical input on vendor statements of work.
Assess IAM-related risks and control gaps, recommend and drive remediation, and present findings and solutions to IT leadership.
Lead IAM’s technical role in internal and external audits and regulatory compliance activities, designing sustainable and auditable controls.
Partner with application owners, Human Resources, infrastructure, operational technology, and business leaders to define access requirements and IAM service boundaries; independently lead working sessions with senior leadership.
Identify gaps in IAM processes, tooling, and capabilities and drive improvements that make IAM services more automated, reliable, and scalable.
Ensure IAM disaster recovery, redundancy, and resilience plans are designed, tested, and maintained.
Comply with company policies and procedures and maintain knowledge of regulations, laws, standards, and best practices applicable to the functional area.
Be able to work overtime at any time of day or week as an essential function of supporting continuous, reliable electric service.
Travel as needed, approximately 15% of the time; perform on-call duty as assigned.
Successfully complete and maintain a NERC CIP personnel risk assessment and required NERC CIP training before receiving access to NERC CIP-protected systems and information.

Benefits

Medical insurance
Dental insurance
Vision insurance
Health Savings Account (HSA)
Flexible Spending Accounts (FSA)
Tuition reimbursement
Flexible work schedules, including compressed work week and telecommuting opportunities to work remotely up to 40%
Life insurance
401(k)
Long-term disability
Short-term disability
Employee Assistance Program (EAP)
Paid leave benefits