Identity Operations Engineer

Universal Music Group•Nashville, TN

2d•$75,305 - $100,000

About The Position

As a key member of the UMG Operations Center, the Identity Operations Engineer operates and continuously improves UMG’s hybrid identity, access, authentication, privileged-access, and identity-governance services. The role provides specialist operational support across Workday-driven identity lifecycle processes, Saviynt/IGA, Active Directory, Microsoft Entra ID, Microsoft 365, MFA, PAM, enterprise application integrations, and connected services. The position works as part of a team to maintain reliable identity integrations and resolve operational issues involving joiners, movers, leavers, contractors, rejoiners, application access, entitlements, authentication, privileged accounts, and non-human identities. Work includes incident, request, change, problem, access-review, audit-evidence, monitoring, and automation activities. The role partners with Engineering, Architecture, Cloud, Observability, ITSM, security, regional IT teams, and external providers, and requires effective communication across varied cultural and technical backgrounds in a global business environment. This is a shift-based role supporting UMG’s 24/7 follow-the-sun Technical Operations Center. It includes scheduled shifts, weekend and public-holiday coverage, on-call rotation, and structured handoffs with regional operations teams.

Requirements

At least five years of directly related Identity & Access Management (IAM) experience.
Solid technical skills in identity management, including Active Directory and Microsoft Entra ID.
Strong troubleshooting and problem-analysis ability, including communicating findings clearly to business stakeholders, IT support teams, and network providers.
Experience resolving issues involving identities, systems, access, accounts, authentication, authorization, entitlements, and permissions.
Hands-on experience operating and supporting Active Directory and Entra ID, including directory services, delegated administration, group policy, OUs, sites/replication, identity synchronization, enterprise applications, federation, Conditional Access, and authentication.
Hands-on experience with Saviynt or another IGA platform, including access requests, approvals, entitlement administration, access reviews, failed-task remediation, reconciliation, and audit evidence.
Experience with identity lifecycle integrations from an authoritative HR source such as Workday, including joiner/mover/leaver, contractor, rehire, and exception handling.
Customer-service focus, proactive and positive approach, commitment to organizational policies, and continuous-improvement mindset.
Hands-on experience with Microsoft 365 and ServiceNow; ServiceNow experience must include IAM incidents, requests, changes, knowledge, evidence, assignment groups, and CMDB relationships.
Current work experience supporting integrated IAM solutions such as Entra ID, Active Roles where applicable, Duo, PKI, and CyberArk/PAM.
Working knowledge of site-reliability and operational-engineering principles, monitoring, automation, and safe use of AI-assisted tools.
Organizational skills, attention to detail, and ability to work independently and as part of a team.
Strong written, oral, and interpersonal communication skills.
Ability to work scheduled shifts, weekend and public-holiday coverage, and on-call rotation in a 24/7 operations environment.

Nice To Haves

Bachelor’s degree in computer science, engineering, or a closely related field, or comparable education and experience.
Experience with at least two of PingOne/Aura, 1Password, HashiCorp Vault, Microsoft Graph, SAML/OIDC/OAuth, enterprise application onboarding, or secrets/service-account rotation.
Experience integrating or troubleshooting ServiceNow orchestration with identity platforms, directories, SaaS applications, or enterprise applications.
Understanding of Microsoft 365 identity, group, collaboration, and federation dependencies.
Experience using PowerShell, Python, JSON/REST, Microsoft Graph, SQL, or comparable scripting/API technologies for IAM automation and troubleshooting; legacy Java, SOAP, or database experience.
IT certifications such as MCSE specialization in Identity Management, Certified Access Management Specialist (CAMS), or ITIL Foundations.
International experience; multiple language skills are a plus.

Responsibilities

Apply least-privilege, segregation-of-duties, secure-administration, and identity-governance practices to protect UMG information resources.
Troubleshoot identity, system, access, account, authentication, authorization, entitlement, and permission issues.
Investigate and resolve specialist escalations from AD Services and TechOps IAM queues, including application-role access, SecAdmin access, reference-user comparisons, disabled application accounts, access removals, and entitlement issues.
Provide ITIL-based operational support for identity services, including incidents, requests, changes, problems, and major incidents; maintain ServiceNow assignments, evidence, troubleshooting notes, resolution details, and closure criteria.
Operate and troubleshoot identity lifecycle integrations for joiners, movers, leavers, contractors, rehires/rejoiners, and exceptions; investigate failed provisioning, reconciliation issues, orphaned accounts, and data mismatches.
Support Workday-driven lifecycle processes and Saviynt/IGA workflows, including access requests, approvals, entitlement ownership, access reviews, remediation, audit evidence, and provisioning or reconciliation failures.
Operate and support on-premises and cloud identity services and their configurations, including Active Directory, Microsoft Entra ID, Microsoft 365, Duo, YubiKey/FIDO/PIV, CyberArk/PAM, Saviynt/IGA, Splunk, and connected applications and services.
Troubleshoot Entra enterprise applications and federation integrations, including SAML, OIDC/OAuth, claims, redirect URIs, app registrations, group assignments, Conditional Access, Microsoft Graph, certificates, and token or authentication failures.
Support privileged and non-human identities, including elevated, service, application, RPA, resource/test, B2B/guest, and other accounts requiring vault onboarding, password rotation, or ownership validation.
Support MFA and authentication operations, including Duo, YubiKey, FIDO/PIV, recovery/reset workflows, OAuth-token issues, and authentication failures.
Complete required key-metric reporting and analysis for the Identity Management environment.
Ensure identity-management audit tasks are completed on time with appropriate participants; maintain auditable evidence for approvals, reviews, privileged access, lifecycle actions, exceptions, and remediation.
Participate in security incident response as needed, including identity compromise, suspicious authentication, privileged-access, credential, and account-containment activities.
Apply industry best practices to standards, processes, procedures, tools, and documentation.
Ensure IAM systems are maintained, patched, operated, and monitored on schedule; use Splunk and observability dashboards to identify failures, trends, and emerging operational risks.
Maintain accurate ServiceNow CMDB relationships for identity services, configuration items, application integrations, owners, support groups, and dependencies; identify and report stale or incomplete data.
Participate in developing automation to reduce time spent on routine tasks.
Participate in scheduled shift coverage, weekend and public-holiday coverage, on-call rotation, and structured handoffs with regional operations teams.

Benefits

Comprehensive medical, dental, and vision coverage.
100% coverage for out-patient in-network mental health services.
Fertility coverage for eligible medical-plan participants.
Wellbeing reimbursements for fitness classes, spa treatments, meal services, travel, and more, up to $720 per year.
Student loan repayment assistance and tuition reimbursement.
401(k) with 100% immediate vesting on the first 5% of employee contributions, plus an additional UMG contribution.
Flexible paid time off for exempt employees.
Three weeks of PTO for non-exempt employees.
Two weeks of paid Winter Break.
Ten company holidays, including Juneteenth and Wellbeing Day.
Summer Fridays between Memorial Day and Labor Day.
Paid parental leave for every type of parent.