Lead Identity & Access Management Engineer

UMass Amherst•Amherst, NY

15h•Hybrid

About The Position

The Lead Identity and Access Management (IAM) Engineer provides technical leadership for the university’s enterprise-wide IAM program. The role leads the design, implementation, integration, and continuous improvement of authentication, authorization, identity provisioning, and identity governance and administration (IGA) solutions across university systems, audiences, and applications. Combining hands-on technical expertise with cross-functional collaboration, the engineer helps shape the technical vision and roadmap for IAM services, aligns solutions with institutional security and compliance requirements, and guides IAM professionals. The role manages risk associated with the university’s IAM posture while helping safeguard institutional assets and optimize the usability and value of identity services. It requires deep expertise in IAM concepts and workflows, IGA platforms, authentication and authorization applications and protocols, and enterprise services in a complex higher education environment. The position is full time and hybrid, based in Amherst. Work is generally Monday through Friday, 8:30 a.m. to 5 p.m. Occasional travel between campuses or off-site locations may be required, and on-call availability may be needed for critical IAM system incidents. Work is performed in a standard office or indoor university environment with minimal physical exertion. The role is subject to the Professional Staff Union collective bargaining agreement and final budgetary and administrative approval.

Requirements

Bachelor’s degree in computer science, information technology, cybersecurity, or a related field and more than 9 years of progressive professional IT experience; or an associate’s degree in one of these fields and more than 11 years of progressive professional IT experience.
Five years of experience focused on identity and access management.
Two years of experience in a technical lead or team lead capacity, providing guidance, mentorship, or oversight to technical staff.
Demonstrated expertise in IAM systems such as Active Directory, Azure AD/Entra ID, LDAP, and identity governance platforms.
Strong knowledge of security protocols and authentication methods such as SAML, OAuth 2.0, OpenID Connect, Kerberos, and RADIUS.
Strong understanding of and experience with information security frameworks, privacy laws, and regulatory requirements such as NIST, FERPA, HIPAA, and PCI-DSS.
Demonstrated experience in architectural design and implementation of IAM best practices.
Proficiency in identity lifecycle management, including automated provisioning, deprovisioning, and access certification processes.
Experience with cloud-based identity management solutions and hybrid identity architectures.
Excellent written and verbal communication skills, including the ability to communicate with non-technical end users, executive stakeholders, and technical staff.
Demonstrated ability to lead technical teams, set priorities, and drive projects to completion.
Excellent organizational and time-management skills, including the ability to multitask and adjust to rapidly changing priorities.
Strong problem-solving and analytical skills, including the ability to conduct complex risk assessments.
Excellent customer service skills and ability to provide efficient technical support to diverse audiences.
Ability to work in a fast-paced team environment and adapt quickly to new technologies.

Nice To Haves

Master’s degree in computer science, cybersecurity, information technology, or a relevant field.
Industry certifications such as CISSP, CISM, CISA, or vendor-specific IAM certifications such as Microsoft Identity and Access Administrator or Certified Identity and Access Manager.
Expert knowledge of Fischer Identity, Azure AD (Entra ID), SSO, Active Directory, and Cirrus Identity.
Expert knowledge of access control models including RBAC, ABAC, and PBAC.
Experience in higher education or other large, complex organizations serving diverse user populations.
Experience with IGA platforms and workflows.
Knowledge of zero trust architecture principles and their application to IAM.
Experience with API security, service accounts, and non-person entity management.
Supervisory experience managing a small team, including conducting performance evaluations.
Excellent policy and procedure development skills.

Responsibilities

Provide technical leadership and help inform strategic direction for the university’s IAM ecosystem, including authentication services, access controls, identity governance, and related middleware.
Collaborate on architectural design, development, and documentation of legacy and new information systems supporting IAM services across on-premises and cloud environments.
Configure and maintain IGA platforms, including identity lifecycle management, automated provisioning and deprovisioning, access requests and approvals, rectifications, and entitlement management.
Design and implement enterprise IAM architecture, including single sign-on (SSO), multi-factor authentication (MFA), identity federation, and automated provisioning workflows.
Analyze complex technical problems, develop innovative solutions, and research, evaluate, recommend, and lead integration of solutions within existing computing environments.
Install, configure, and maintain operating system components, applications, application servers, and integrations supporting IAM infrastructure.
Collaborate with system owners, administrators, stakeholders, IT security teams, external partners, and vendors to implement IAM standards and integrate IAM solutions.
Manage and optimize provisioning and deprovisioning processes across the identity lifecycle.
Ensure periodic access reviews and certifications are performed, documented, and remediated.
Apply appropriate IAM auditing and monitoring across university systems.
Review and update access policies in response to organizational needs and compliance requirements.
Communicate with customers and stakeholders to elicit requirements, present solutions, and investigate and resolve issues.
Ensure IAM systems remain in documented compliance with applicable frameworks, regulations, and agreements, including NIST, FERPA, HIPAA, PCI-DSS, and CMMC.
Research, recommend, and promote security policies and guidelines to protect the confidentiality, integrity, and availability of university accounts, data, and computer assets.
Monitor and audit access controls to prevent unauthorized access and detect anomalous activity.
Participate in incident response and investigations related to access control breaches.
Stay informed about IAM industry trends and emerging technologies.
Represent IAM in university committees, working groups, and governance bodies as needed.
Perform other duties as requested or required.