Identity & Access Management Engineer

Davidson College•Davidson, NC

About The Position

The Identity & Access Management Engineer is accountable for the identity infrastructure at Davidson College, including the identity provider and single sign-on integrations, the hybrid Active Directory and Entra ID directory, RapidIdentity Cloud account management, Duo multi-factor authentication, InCommon certificate and trust infrastructure, and provisioning and deprovisioning workflows. The role defines identity architecture and lifecycle requirements, validates and troubleshoots automated account-lifecycle integrations, and works with Platform Engineering, Information Security, and campus data owners such as HR and the Registrar. It also extends identity standards to non-human actors, including service accounts, API access, and agents. The role administers identity, directory, and authentication services; handles escalated identity requests; monitors authentication health; supports access reviews, audit and compliance requests; and advises on identity for projects, procurement, and architecture reviews. It maintains documentation and operational runbooks and administers the servers and supporting infrastructure used by identity processes, including patching, security, backup and recovery, and restoration testing. The position participates in documented change management and the Infrastructure on-call rotation, and automates operational tasks using scripting and AI-assisted development techniques. General server and storage administration remains with the Systems team; this role's systems work is limited to systems supporting identity.

Requirements

Bachelor's degree or an equivalent combination of education and relevant experience.
5+ years in systems administration, identity management, or a related discipline, with hands-on identity provider and SSO administration.
Strong working knowledge of Active Directory and Entra ID, including hybrid synchronization and conditional access.
Practical understanding of identity protocols and standards: SAML, OIDC/OAuth, LDAP, and SCIM.
Scripting proficiency in PowerShell, Python, or a similar language for identity automation.
Security-first mindset with experience implementing MFA (Duo or a comparable platform) and least-privilege access models.
Clear communication with technical and non-technical audiences and strong documentation habits.

Nice To Haves

Experience with RapidIdentity Cloud or comparable identity lifecycle and account management suites, and with administering Duo.
Experience with InCommon, certificate management, or PKI, including automating certificate renewal.
Experience supporting identity for AI and agentic platforms, API access management, or service-account governance.
Higher education experience, including FERPA- and GLBA-aware access design.
Relevant certifications, such as Microsoft Identity and Access Administrator.
Familiarity with identity threat detection and response tooling.

Responsibilities

Administer and evolve the identity provider and single sign-on environment, including SAML, OIDC, and OAuth service-provider integrations for campus and cloud applications.
Define identity lifecycle requirements and design for provisioning, role and affiliation changes, and deprovisioning; validate automated account-lifecycle integrations and troubleshoot and fix existing RapidIdentity action sets and directory synchronization connectors, partnering with Platform Engineering on new development.
Administer RapidIdentity Cloud and related identity platforms, including account creation, updates, and removal; manage role- and group-based access models across systems.
Administer Duo multi-factor authentication and implement and maintain conditional access and privileged access controls.
Maintain certificate and trust infrastructure, including InCommon certificate services, application and SAML signing certificates, and internal PKI touchpoints; automate renewals and expiration alerting.
Resolve escalated identity requests involving access, MFA, and lifecycle exceptions, and use request patterns to reduce manual steps through automation and self-service.
Design and run periodic access reviews and support audit and compliance requests, including FERPA- and GLBA-driven access controls.
Administer the hybrid directory environment, including Active Directory, Entra ID, directory synchronization, and group policy relevant to identity and access.
Monitor authentication health, respond to alerts including identity threat intelligence alerts, and participate in incidents with Information Security.
Maintain directory integration points with downstream systems such as email, storage, and organization-group-driven entitlements; troubleshoot access inconsistencies.
Serve as T&I's consulted identity expert for projects, procurements, and architecture reviews; extend identity standards to service accounts, API access, and agents on the agentic platform.
Consult with campus offices on access needs and data-owner responsibilities.
Maintain documentation, runbooks, and knowledge transfer so identity operations are diagnosable and not dependent on one person.
Maintain, patch, and secure on-premises and cloud servers that support identity processes, using Infrastructure team's patching and monitoring tools.
Support backup and recovery for identity systems, including restoration testing.
Participate in documented change management (CAB) and share in the Infrastructure on-call rotation.
Automate operational tasks with scripting and AI-assisted development techniques.