Identity Operations Engineer

Universal Music•Nashville, TN

About The Position

As a key member of UMG’s Operations Center, the Identity Operations Engineer operates and continuously improves UMG’s hybrid identity, access, authentication, privileged-access, and identity-governance services. The role provides specialist operational support for Workday-driven identity lifecycle processes, Saviynt/IGA, Active Directory, Microsoft Entra ID, Microsoft 365, MFA, PAM, enterprise application integrations, and connected services. It helps maintain reliable identity integrations and resolve operational issues involving joiners, movers, leavers, contractors, rejoiners, application access, entitlements, authentication, privileged accounts, and non-human identities. The role covers incident, request, change, problem, access-review, audit-evidence, monitoring, and automation activities. It partners with Engineering, Architecture, Cloud, Observability, ITSM, security, regional IT teams, and external providers, communicating effectively across a global business with diverse cultural and technical backgrounds. This is a shift-based role supporting UMG’s 24/7 follow-the-sun Technical Operations Center. It includes scheduled shifts, weekend and public-holiday coverage, an on-call rotation, and structured handoffs with regional operations teams.

Requirements

Minimum five years of directly related Identity & Access Management (IAM) experience.
Solid technical skills in Identity Management, including Active Directory and Entra ID.
Strong troubleshooting and problem-analysis ability, including clearly communicating findings to business stakeholders, IT support teams, and network providers.
Experience troubleshooting issues involving identities, systems, access, accounts, authentication, authorization, entitlements, and permissions.
Hands-on experience operating and supporting Active Directory and Entra ID, including directory services, delegated administration, Group Policy, OUs, sites/replication, identity synchronization, enterprise applications, federation, Conditional Access, and authentication.
Hands-on experience with Saviynt or another IGA platform, including access requests, approvals, entitlement administration, access reviews, failed-task remediation, reconciliation, and audit evidence.
Experience with identity lifecycle integrations from an authoritative HR source such as Workday, including joiner/mover/leaver, contractor, rehire, and exception handling.
Customer-service focus and a proactive, positive, can-do approach.
Commitment to the organization’s policy framework and continuous improvement.
Hands-on experience with Microsoft 365 and ServiceNow.
Experience using ServiceNow for IAM incidents, requests, changes, knowledge, evidence, assignment groups, and CMDB relationships.
Current work experience supporting integrated IAM solutions such as Entra ID, Active Roles where applicable, Duo, PKI, and CyberArk/PAM.
Working knowledge of site-reliability or operational-engineering principles, monitoring, automation, and safe use of AI-assisted tools.
Organizational skills, attention to detail, and ability to work independently and as part of a team.
Solid written, oral, and interpersonal communication skills.
Ability to participate in scheduled shifts, weekend/public-holiday coverage, and an on-call rotation.

Nice To Haves

Bachelor’s degree in computer science, engineering, or a closely related field, or comparable education and experience.
Experience with at least two of the following: PingOne/Aura, 1Password, HashiCorp Vault, Microsoft Graph, SAML/OIDC/OAuth, enterprise application onboarding, or secrets/service-account rotation.
Experience integrating or troubleshooting ServiceNow orchestration with identity platforms, directories, SaaS applications, or enterprise applications.
Understanding of Microsoft 365 identity, group, collaboration, and federation dependencies.
Experience with PowerShell, Python, JSON/REST, Microsoft Graph, SQL, or comparable scripting/API technologies for IAM automation and troubleshooting.
Legacy Java, SOAP, or database experience.
IT certifications such as MCSE, a specialization in Identity Management, Certified Access Management Specialist (CAMS), or ITIL Foundations.
International experience; multiple language skills are a plus.

Responsibilities

Apply least-privilege, segregation-of-duties, secure-administration, and identity-governance best practices to protect UMG information resources.
Troubleshoot and resolve identity, system, access, account, authentication, authorization, entitlement, and permission issues.
Investigate and resolve specialist escalations from AD Services and TechOps IAM queues, including application-role access, SecAdmin access, reference-user comparisons, disabled application accounts, access removals, and entitlement issues.
Provide ITIL-based operational support for identity services, including incidents, requests, changes, problems, and major incidents; maintain ServiceNow assignment details, evidence, troubleshooting notes, resolutions, and closure criteria.
Operate and troubleshoot identity lifecycle integrations for joiners, movers, leavers, contractors, rehires/rejoiners, and exceptions; investigate failed provisioning, reconciliation issues, orphaned accounts, and data mismatches.
Support Workday-driven lifecycle processes and Saviynt/IGA workflows, including access requests and approvals, entitlement ownership, access reviews, remediation, audit evidence, and provisioning or reconciliation failures.
Operate and support on-premises and cloud identity services and configurations, including Active Directory, Microsoft Entra ID, Microsoft 365, authentication, PAM, IGA, and connected enterprise applications.
Troubleshoot Microsoft Entra enterprise applications and federation integrations, including SAML, OIDC/OAuth, claims, redirect URIs, app registrations, group assignments, Conditional Access, Microsoft Graph, certificates, and token or authentication failures.
Support privileged and non-human identities, including elevated, service, application, RPA, resource/test, B2B/guest, and other accounts requiring vault onboarding, password rotation, or ownership validation.
Support MFA and authentication operations, including Duo, YubiKey, FIDO/PIV, recovery and reset workflows, OAuth-token issues, and authentication failures.
Complete required Identity Management metric reporting and analysis, and ensure audit tasks are completed on time with appropriate participants.
Maintain auditable evidence for access approvals, reviews, privileged access, lifecycle actions, exceptions, and remediation.
Participate in security incident response as needed, including identity compromise, suspicious authentication, privileged access, credentials, and account containment.
Apply industry best practices in standards, processes, procedures, tools, and documentation.
Ensure IAM system maintenance, patching, operation, and monitoring are completed on schedule.
Use Splunk and observability dashboards to identify failures, trends, and emerging operational risk.
Maintain accurate ServiceNow CMDB relationships for identity services, configuration items, application integrations, owners, support groups, and dependencies; identify and report stale or incomplete data.
Participate in developing automation to reduce time spent on routine tasks.
Participate in scheduled shifts, weekend and public-holiday coverage, on-call rotation, and structured handoffs with regional operations teams.

Benefits

Comprehensive medical, dental, and vision coverage.
100% coverage for out-patient in-network mental health services.
Fertility coverage for eligible medical plan participants.
Wellbeing reimbursements for fitness classes, spa treatments, meal services, travel, and more, up to $720 per year.
Student Loan Repayment Assistance and Tuition Reimbursement.
401(k) with 100% immediate vesting on the first 5% of employee contributions, plus an additional UMG contribution.
Flexible Paid Time Off for exempt employees.
Three weeks of PTO for non-exempt employees.
Two weeks of paid Winter Break.
10 company holidays, including Juneteenth and Wellbeing Day.
Summer Fridays between Memorial Day and Labor Day.
Generous paid parental leave for every type of parent.