Identity & Access Management Engineer

Sonar•Geneva, IL

About The Position

Sonar is seeking an experienced Identity & Access Management (IAM) Engineer to design, build, and operate identity platforms that secure access to applications, infrastructure, and data. The role owns the technical direction of Sonar’s IAM ecosystem, including authentication, authorization, identity lifecycle management, and privileged access. The engineer will collaborate with security, IT, engineering, and compliance teams to deliver a secure, scalable, and user-friendly access experience aligned with Zero Trust principles. The role is based in Geneva. Sonar is unable to consider candidates unwilling to be in Geneva, but is willing to relocate the right candidate. All offers are contingent on a comprehensive background check and reference verification before the start date. Applications submitted through agencies or third-party recruiters will not be considered. Sonar may use AI tools to support parts of hiring, but final hiring decisions are made by humans.

Requirements

6 to 15 years of experience in IAM, security engineering, or a related field.
Hands-on experience with at least one major IAM platform, such as Okta, Microsoft Entra ID (Azure AD), Ping Identity, ForgeRock, SailPoint, or CyberArk.
Strong knowledge of identity protocols and standards: SAML 2.0, OAuth 2.0, OpenID Connect, SCIM, LDAP, and Kerberos.
Experience with Active Directory and directory services architecture.
Proficiency in at least one scripting or programming language: Python, PowerShell, Go, Java, or JavaScript.
Solid understanding of cloud IAM models, including AWS IAM, Azure RBAC, and GCP IAM.
Experience with MFA, passwordless authentication, and conditional or risk-based access.
Familiarity with Zero Trust, least privilege, and defense-in-depth principles.
Strong analytical, problem-solving, and communication skills.
Willingness to be based in Geneva.

Responsibilities

Design, implement, and maintain enterprise IAM solutions, including SSO, MFA, federation, and directory services.
Architect and manage joiner/mover/leaver identity lifecycle processes, automating provisioning and deprovisioning across SaaS, cloud, and on-premises systems.
Implement and operate Privileged Access Management (PAM), including vaulting, session management, and just-in-time access.
Lead Identity Governance and Administration (IGA) initiatives, including access reviews, certifications, role-based access control (RBAC), and segregation-of-duties controls.
Integrate applications with the identity platform using SAML, OIDC, OAuth 2.0, SCIM, and LDAP.
Develop automation and tooling, including APIs, scripts, CI/CD pipelines, and Infrastructure as Code, to reduce manual identity operations.
Secure cloud identity and access across AWS, Azure, and/or GCP, including IAM policies, workload identity, and service accounts.
Define and enforce authentication and authorization standards, policies, and best practices.
Monitor identity-related threats and support detection and response for account compromise, credential abuse, and privilege escalation.