Principal IAM Engineer

Lantern

9d•Remote

About The Position

Lantern is a specialty care platform that connects people with high-quality, affordable specialty care. The company operates in a regulated healthcare environment, handles protected health information (PHI) at scale, and has made AI adoption a top company priority. The Principal IAM Engineer is a senior-level individual contributor and Lantern’s technical authority for identity. Reporting to the CISO, this hands-on role owns the identity control plane end to end: setting identity standards, building automation, and verifying controls that govern access to PHI. The role partners with the IAM engineer and platform, cloud, and service delivery teams, setting standards for partner teams to execute. It is not currently a people-management role, though the scope may grow into a leadership role as the identity function expands. Lantern’s security philosophy is “open by default, secure by design.” The role helps the business move quickly and safely by embedding guardrails in platforms, pipelines, and tooling, reserving gates for risks that warrant them and making those gates automated, fast, and transparent. Service Delivery performs provisioning and resets against the role’s verification standards; Cloud Engineering operates cloud access, workload identity, and key-management systems; HR events trigger lifecycle changes; and Governance, Risk & Compliance independently attests to entitlements. Access certification remains outside this role to preserve separation between granting access and reviewing it. The position is remote. First-year priorities include enforcing and verifying Conditional Access on PHI-facing applications; delivering reliable automated joiner, mover, and leaver processes; establishing a secrets golden path and key-to-owner registry; strengthening phishing-resistant MFA coverage for privileged accounts; and documenting runbooks and control-plane knowledge so critical controls do not depend on one person.

Requirements

Eight or more years of identity and access management experience, including principal- or staff-level ownership of an identity control plane.
Deep Microsoft Entra ID engineering experience, including Conditional Access policy design, phishing-resistant MFA, single sign-on, and federation across SAML, OIDC, and OAuth2, with enforcement verified across access paths.
Experience automating identity lifecycle processes across cloud, SaaS, and privileged systems, including RBAC/ABAC provisioning and deprovisioning verification against an entitlement inventory.
Experience designing Zero Trust identity controls, including least privilege, just-in-time access, and risk-based or adaptive access controls.
Identity governance and administration platform engineering experience, including privileged access management.
Automation and scripting experience with PowerShell, Python, or similar tools to build lifecycle workflows and custom connectors.
Identity-as-code and policy-as-code experience using Terraform and source-controlled change management, such as GitHub.
Experience with secrets and non-human identities, including API keys, service accounts, and workload identity, and maintaining an owner registry.
Experience governing key access and separation of duties when another team operates the key management system.
Ability to act as a technical authority without formal people-management authority and work directly to a CISO.
Bachelor’s degree in a relevant field or equivalent professional experience.

Nice To Haves

Experience in healthcare or another regulated environment where identity controls gate access to PHI.
Hands-on Saviynt experience with PAM, Azure PIM, and Keeper, or transferable depth in comparable platforms.
Experience remediating a Conditional Access enforcement gap or deprovisioning failure and making a structural change to prevent recurrence.
Experience with passkeys, FIDO2, or phishing-resistant authenticators aligned with NIST SP 800-63 Rev. 4.
Experience expanding a technical scope into a broader leadership remit.
Microsoft Identity and Access Administrator certification, CIMP, or equivalent.

Responsibilities

Own identity lifecycle provisioning and deprovisioning for joiners, movers, and leavers using automated role- and attribute-based models, with deprovisioning verified against an entitlement inventory.
Own access management, including Conditional Access, phishing-resistant MFA, and privileged access based on Zero Trust, least privilege, just-in-time elevation, and verified enforcement across every access path.
Own directory and federation across Microsoft Entra ID, single sign-on, SAML, OIDC, and OAuth2.
Own secrets and non-human identity, including API keys, service accounts, and workload identity, and maintain an owner registry.
Govern key access and separation of duties where another team operates the key management system.
Build identity automation and identity-as-code, delivering lifecycle and access controls as reviewable, version-controlled infrastructure using Terraform and policy-as-code.
Set and own the identity-verification standard followed by the service desk for password resets, MFA resets, and device enrollment.
Set identity standards for partner teams and maintain clear operational boundaries with Service Delivery, Cloud Engineering, HR, and Governance, Risk & Compliance.
Deliver first-year priorities: verified Conditional Access enforcement on PHI-facing applications; reliable automated lifecycle processes; a vaulted-secrets golden path with no secrets in code and a populated key-to-owner registry; phishing-resistant MFA coverage on privileged accounts; and documented runbooks and control-plane depth.