Identity Governance and Administration Senior Engineer - AVP

MUFG•Jersey City, NJ

3d•$112,000 - $153,000•Hybrid

About The Position

MUFG is hiring a hands-on Identity Governance and Administration (IGA) Engineer for its Global IAM Engineering team. This individual-contributor role at AVP level designs, builds, implements, maintains, and operates the IGA platform governing workforce and non-human access across the Americas, EMEA, and Asia Pacific. The engineer is expected to work independently from requirements through production delivery, translating business and control requirements into technical designs, implementing and testing solutions, supporting audit evidence needs, and resolving complex production issues through structured troubleshooting and root cause analysis. The role requires deep IGA expertise across identity lifecycle management, access requests and approvals, provisioning and de-provisioning, access certification, role and entitlement management, policy and segregation of duties, application onboarding, and non-human identity governance. It follows an automation-first operating model: the engineer builds forms, workflows, rules, and integrations that enable end-to-end processes with minimal human intervention and reduce manual tasks, tickets, and exceptions. Close integration with ServiceNow, HR systems, directories, applications, and Privileged Access Management platforms through APIs and connectors is central to the work. The engineer collaborates with Security, IT Risk, Compliance, HR, Infrastructure, application owners, Service Desk, and vendors; coaches junior engineers; documents designs and standards; and explains technical topics clearly to technical and non-technical stakeholders. The position is based on a hybrid schedule of four days per week at an MUFG office or client site and one remote day per week. The stated base salary range is $125,000–$153,000 in New York/New Jersey and $112,000–$141,000 elsewhere, depending on job-related knowledge, skills, experience, and location. The role may also be eligible for discretionary performance-based bonus and/or incentive compensation. MUFG lists comprehensive health and wellness benefits, retirement plans, educational assistance and training programs, income replacement for qualified employees with disabilities, paid maternity and parental bonding leave, and paid vacation, sick days, and holidays.

Requirements

6–10 years of IAM experience, including at least 4 years of hands-on IGA engineering experience in enterprise, multi-region environments with large user populations (10,000+ users) and many applications.
Deep knowledge of IGA domains and controls, including identity lifecycle, access requests and approvals, provisioning and reconciliation, access certification, RBAC and role modelling, entitlement management, segregation of duties and policy management, orphan and dormant accounts, and non-human identity governance.
Proven IGA platform engineering delivery, including connectors and application onboarding, aggregation and correlation, identity profiles and lifecycle states, transforms, rules, workflows, forms, certification campaigns, policies, reports, and event triggers; understanding of platform architecture and environment promotion.
Ability to design user-friendly request and approval forms and efficient, fault-tolerant workflows that enforce controls, minimize approvals and manual steps, and remain maintainable.
Hands-on experience integrating IGA with ServiceNow, including its service catalog, record producers and variables, Flow Designer or IntegrationHub, scripted REST APIs, RITM and task fulfilment, and incident, problem, and change processes.
Strong experience with REST/SOAP web services, SCIM, JSON and XML, OAuth and token-based authentication, and tools such as Postman; ability to build, test, and debug integrations with HR systems, directories, databases, cloud and SaaS applications, and PAM platforms.
At least 5 years of process automation through scripting or coding, including Java and BeanShell, JavaScript (Identity Security Cloud), and PowerShell and/or Python; ability to write SQL queries; familiarity with Git and CI/CD for controlled deployments.
Demonstrated ability to troubleshoot complex production issues end to end, perform structured root cause analysis, and deliver lasting fixes.
Solid Cyber Security and IAM fundamentals, including authentication and authorization, SSO and federation (SAML, OAuth 2.0, OpenID Connect), MFA, least privilege, segregation of duties, Zero Trust, privileged access, directory services (Active Directory, Entra ID, LDAP), cloud identity, and common identity threats and risks.
Understanding of IAM processes and controls, external audit and SOX requirements, and frameworks such as NIST, CRI, DORA, and SOX; experience supporting evidence collection, control testing, and remediation.
Experience with critical production support, application upgrades, project lifecycle and SDLC processes, release and change management, and ITSM practices including incident, problem, change, and SLAs.
Track record of reducing manual effort and ticket volume through workflows, APIs, and orchestration; interest in AI-assisted support under strong governance and auditability.
Excellent written and verbal communication, structured problem solving, ownership, attention to detail, ability to work independently and collaboratively, and ability to explain technical topics clearly to senior and non-technical stakeholders.
Bachelor’s degree in Computer Science or a closely related discipline, or relevant work experience.
Candidates must demonstrate sound Cyber Security and IAM fundamentals through recognized qualifications or proven experience.

Nice To Haves

IGA vendor certification, such as SailPoint Certified Identity Security Engineer (Identity Security Cloud).
Security and IAM certifications such as CISSP, CISM, CompTIA Security+, Microsoft SC-300, or equivalent professional qualifications.
ServiceNow certification, such as Certified System Administrator or Certified Application Developer, or demonstrable ServiceNow development experience.
Knowledge of Privileged Access Management principles, processes, and tools such as CyberArk, and their integration with IGA.
Exposure to cloud identity patterns (AWS, Azure, GCP), Microsoft Entra ID, and CI/CD access models.
Experience applying AI agents or AI-assisted support in IT or security operations with strong governance and auditability.
Financial Services experience and knowledge of financial regulations, compliance, and standards.
Bachelor’s degree in Computer Science or a related discipline.

Responsibilities

Design, configure, build, test, and deploy IGA capabilities, including lifecycle management, access requests, certifications, role and policy management, segregation of duties, provisioning, and reconciliation.
Implement automated, evidenced, and traceable IGA controls for identity lifecycle, birthright and role-based access, access recertification, segregation of duties, orphan and dormant accounts, and privileged and non-human identities.
Design and develop reusable, documented access request forms, approval and fulfilment workflows, lifecycle events, rules, transforms, and notifications.
Automate provisioning, approvals, reconciliation, and certification using event-driven workflows, rules, scheduled tasks, and APIs; track reductions in manual effort, exceptions, and ticket volume.
Onboard applications and authoritative sources using connectors, web services, JDBC, LDAP, and SCIM, including correlation, aggregation, and entitlement modelling.
Build and maintain bidirectional integrations between IGA and ServiceNow for catalog items, request and task fulfilment, status updates, incidents, problems, and changes.
Develop, secure, and support REST/SOAP and SCIM integrations with HR, ITSM, PAM, directory, cloud, and data platforms, including authentication, error handling, retries, logging, and monitoring.
Operate and monitor the IGA platform; diagnose and resolve aggregation, provisioning, workflow, connector, and integration failures; perform root cause analysis and implement permanent fixes.
Support platform upgrades, patching, configuration management, development/test/production environment promotion, disaster recovery readiness, and release control in accordance with SDLC and change management standards.
Produce control evidence, reports, and dashboards; support certification campaigns, SOX and regulatory audits, and remediation tracking; keep control documentation audit-ready.
Maintain accurate identity data, correlation, and attribute mapping across HR and target systems; identify and remediate data issues that cause incorrect access.
Maintain technical designs, configuration standards, runbooks, knowledge articles, and test evidence, and contribute to platform standards and engineering best practices.
Collaborate with Security, IT Risk, Compliance, HR, Infrastructure, application owners, Service Desk, and vendors; coach junior engineers on IGA engineering practices.