Identiy and Access Management Engineer

Easterseals Southern California•Irvine, CA

1d•$101,000 - $126,000

About The Position

The Identity & Access Management (IAM) Engineer is the senior technical owner of identity services in a regulated healthcare environment. The role designs, implements, and operates secure access controls for systems handling Protected Health Information (PHI), leading identity lifecycle management, authentication and authorization, application integration, privileged access management, and identity governance across Active Directory, Okta, and Microsoft Entra ID. Working independently, the engineer defines identity standards, access control models, and integration patterns; reduces privileged access risk through privileged access management (PAM) and just-in-time access; and serves as the senior escalation point for authentication and federation issues. The role partners with IT Security leadership to align identity controls with HIPAA, HITRUST, and internal security requirements, while supporting a safe, compliant, and responsive workplace injury management process. The position owns Okta as the primary identity platform, including single sign-on (SSO), multifactor and adaptive authentication, lifecycle management, and SaaS application access. It advances passwordless, phishing-resistant authentication and engineers integrations using SAML, OIDC/OAuth 2.0, and SCIM. The engineer designs automated joiner, mover, and leaver workflows from Workday through Okta, Entra ID, Active Directory, and downstream applications, and owns the enterprise PAM platform, including credential vaulting and rotation, session management and recording, and secrets management. The role requires a bachelor’s degree in Information Technology, Information Security, or a related field, or equivalent practical experience, and at least seven years of experience in IAM or a closely related information security role. It requires technical expertise across Okta, Active Directory, Microsoft Entra ID, enterprise PAM, identity integrations, scripting and automation, identity lifecycle management, access controls, and secure access to cloud and enterprise healthcare applications. Candidates must successfully pass and maintain required background screenings, fingerprint clearances, and drug testing. The role has no direct reports or direct budget or revenue responsibility. Local travel may be required up to 10% of the time. The hiring salary range is $101,000–$126,000 per year.

Requirements

Bachelor’s degree in Information Technology, Information Security, or a related field, or equivalent practical experience.
At least 7 years of experience in Identity & Access Management or a closely related information security role, including demonstrated ownership of identity platform design and implementation.
Technical expertise architecting, securing, and troubleshooting Okta, including SSO, MFA and adaptive authentication policy, passwordless and phishing-resistant authentication, lifecycle management, and Okta Workflows.
Technical expertise architecting, securing, and troubleshooting Active Directory and Microsoft Entra ID, including hybrid identity synchronization, OU and delegation models, Kerberos and LDAP authentication flows, AD replication and FSMO troubleshooting, and privileged tier models with administrative account separation.
Technical expertise architecting, securing, and troubleshooting enterprise PAM platforms, including credential vaulting and rotation, session management, secrets management, and just-in-time privileged access.
Ability to build and troubleshoot identity integrations using SAML, OIDC/OAuth 2.0, and SCIM 2.0, including attribute and schema mapping and non-standard vendor implementations.
Scripting and automation proficiency using PowerShell and/or Python against identity APIs such as Microsoft Graph and Okta.
Applied expertise in identity lifecycle management, role-based access control, least-privilege and separation-of-duties principles, and modern phishing-resistant and passwordless authentication methods.
Experience designing and enforcing device-based access controls, including using device trust and compliance as authentication signals.
Experience securing access to cloud and enterprise healthcare applications in a regulated environment.
Strong attention to detail and documentation discipline, including the ability to produce audit-defensible standards, designs, and procedures.
Must successfully pass and maintain required background screenings, fingerprint clearances, and drug testing in accordance with Easterseals Southern California and program requirements.

Responsibilities

Own Okta as the primary identity platform, including SSO, MFA and adaptive authentication policy, lifecycle management, and SaaS application access; advance passwordless, phishing-resistant authentication.
Engineer identity integrations using SAML, OIDC/OAuth 2.0, and SCIM, including claims and expression logic, attribute mapping, and non-standard vendor implementations.
Design and implement Okta lifecycle workflows automating joiner, mover, and leaver processes from Workday through Okta, Entra ID, Active Directory, and downstream applications.
Own the enterprise PAM platform, including credential vaulting and rotation, session management and recording, and secrets management.
Follow applicable laws, regulations, policies, and procedures, and report potential compliance or risk concerns through appropriate channels.
Use time, materials, equipment, and other resources responsibly and efficiently; perform other duties as assigned.
Determine identity architecture, access control models, authentication methods, and application integration approaches.
Evaluate and resolve complex authentication, federation, provisioning, and access issues, escalating significant security, compliance, or business-impacting concerns to IT Security leadership as appropriate.
Partner with IT Security leadership, IT, HRIS/Workday, application owners, vendors, and business stakeholders to design, implement, troubleshoot, and support identity integrations, access provisioning, and authentication processes.
Maintain audit-ready standards, designs, procedures, and other documentation supporting HIPAA, HITRUST, and internal security requirements.