Lead Identity & Access Management Engineer

UMass Amherst•Amherst, NY

2d•Hybrid

About The Position

The Lead Identity and Access Management (IAM) Engineer provides technical leadership for the university's enterprise-wide IAM program. The position leads the design, implementation, integration, and continuous improvement of authentication, authorization, identity provisioning, and identity governance and administration (IGA) solutions across university systems, audiences, and applications. It combines hands-on technical expertise with cross-functional collaboration to help set the technical vision and roadmap for IAM services, align services with institutional security and compliance requirements, and guide a team of IAM professionals. The role manages risks associated with the university's IAM posture and works with stakeholders to improve security, usability, and value across the university community. The role requires deep expertise in IAM concepts and workflows, IGA platforms, authentication and authorization applications and protocols, and enterprise services in a complex higher education environment. Work is hybrid in a standard office or indoor university environment, with occasional travel between campuses or off-site locations and possible on-call availability for critical IAM incidents. The regular schedule is Monday to Friday, 8:30pm–5pm. The position is subject to final budgetary and administrative approval and to the terms and conditions of the Professional Staff Union collective bargaining agreement.

Requirements

Bachelor's degree in computer science, information technology, cybersecurity, or a related field and more than 9 years of progressive professional IT experience; alternatively, an associate's degree in one of these fields and more than 11 years of progressive professional IT experience.
5 years of experience focused on identity and access management.
2 years of experience in a technical lead or team lead capacity, providing guidance, mentorship, or oversight to technical staff.
Demonstrated expertise in IAM systems such as Active Directory, Azure AD/Entra ID, LDAP, and identity governance platforms.
Strong knowledge of security protocols and authentication methods such as SAML, OAuth 2.0, OpenID Connect, Kerberos, and RADIUS.
Strong understanding of and experience with information security frameworks, privacy laws, and regulatory requirements such as NIST, FERPA, HIPAA, and PCI-DSS.
Demonstrated experience in architectural design and implementation of IAM best practices.
Proficiency in identity lifecycle management, including automated provisioning, deprovisioning, and access certification processes.
Experience with cloud-based identity management solutions and hybrid identity architectures.
Excellent written and verbal communication skills, including the ability to communicate with non-technical end users, executive stakeholders, and technical staff.
Demonstrated ability to lead technical teams, set priorities, and drive projects to completion.
Excellent organizational and time management skills, including the ability to multitask and adjust to rapidly changing priorities.
Strong problem-solving and analytical skills, including the ability to conduct complex risk assessments.
Excellent customer service skills and ability to provide efficient technical support to diverse audiences.
Ability to work in a fast-paced team environment and quickly adapt to new technologies.

Nice To Haves

Master's degree in computer science, cybersecurity, information technology, or a relevant field.
Industry certifications such as CISSP, CISM, CISA, or vendor-specific IAM certifications, including Microsoft Identity and Access Administrator or Certified Identity and Access Manager.
Expert knowledge of Fischer Identity, Azure AD (Entra ID), SSO, Active Directory, and Cirrus Identity.
Expert knowledge of access control models including RBAC, ABAC, and PBAC.
Experience in higher education or other large, complex organizations serving diverse user populations.
Experience with IGA platforms and workflows.
Knowledge of zero trust architecture principles and their application to IAM.
Experience with API security, service accounts, and non-person entity management.
Supervisory experience managing a small team, including conducting performance evaluations.
Excellent policy and procedure development skills.

Responsibilities

Provide technical leadership and help inform strategic direction for the university's IAM ecosystem, including authentication services, access controls, identity governance, and related middleware.
Collaborate on architectural design, development, and documentation of legacy and new information systems supporting IAM across on-premises and cloud environments.
Configure and maintain IGA platforms, including identity lifecycle management, automated provisioning and deprovisioning, access requests and approvals, rectifications, and entitlement management.
Design and implement enterprise IAM architecture, including SSO, MFA, identity federation, and automated provisioning workflows.
Analyze complex technical problems and develop innovative solutions.
Research and evaluate available solutions, recommend adoption strategies, and lead integration efforts in existing computing environments.
Install, configure, and maintain operating system components, applications, application servers, and integrations that support IAM infrastructure.
Collaborate with system owners, administrators, stakeholders, IT security staff, and external partners and vendors to implement IAM standards and solutions.
Manage and optimize provisioning and deprovisioning processes across the identity lifecycle.
Ensure periodic access reviews and certifications are performed, documented, and remediated.
Apply IAM-related auditing and monitoring across university systems.
Review and update access policies to reflect organizational needs and compliance requirements.
Communicate with customers and stakeholders to elicit requirements, present solutions, and investigate and resolve issues.
Ensure IAM systems remain in documented compliance with relevant frameworks, regulations, and agreements, including NIST, FERPA, HIPAA, PCI-DSS, and CMMC.
Research, recommend, and promote security policies and guidelines protecting the confidentiality, integrity, and availability of university accounts, data, and computer assets on premises and in the cloud.
Monitor and audit access controls to prevent unauthorized access and detect anomalous activity.
Participate in incident response and security incident investigations related to access control breaches.
Stay informed about IAM industry trends and emerging technologies.
Represent the IAM function in university-wide committees, working groups, and governance bodies as needed.
Perform other duties as requested or required.