Senior Engineer, Workforce IAM

Cardinal Health

1d•$125,300 - $178,900

About The Position

Cardinal Health is seeking a highly skilled and experienced Identity and Access Management (IAM) Senior Engineer to join its Workforce Identity team. The role architects, scales, and modernizes systems that secure more than 50,000 global employees, contractors, and critical distribution operations. It drives identity strategy across a hybrid, multi-cloud environment; supports rapid mergers, acquisitions, and divestitures (M&A); advances Zero Standing Privilege (ZSP); and develops next-generation non-human and frontline identity solutions. The position defines enterprise IAM architecture standards and reference patterns for SSO, IGA, and directory services; leads identity discovery, migration, federation, and consolidation across business entities and identity providers; and designs secure bridges between legacy on-premises environments, cloud platforms, and SaaS ecosystems. It also advances privileged access and just-in-time governance, evaluates emerging identity security trends, and ensures identity capabilities scale with business expansion and digital healthcare operations. The engineer designs HR-authoritative-source integrations and policy-driven access models, automates identity lifecycle and provisioning workflows, develops SailPoint connectors, and expands cloud entitlement management. The role supports specialized authentication for frontline healthcare, manufacturing, and distribution environments, partners with engineering on highly available provisioning, and collaborates across security, IT, HR, and application teams. It also ensures regulatory compliance, maintains auditable access records, communicates security decisions to diverse stakeholders, and produces technical architecture and operational documentation. The role is expected to apply advanced technical knowledge across complex, large-scale projects, recommend new practices and policies, independently determine approaches to new projects, and mentor less experienced colleagues. It receives guidance on overall project objectives.

Requirements

Bachelor's degree in Computer Science, Information Technology, Information Security, or a related field, or equivalent practical experience.
10+ years of experience in Information Security and Identity Management.
Deep theoretical and practical knowledge of OAuth 2.0, OpenID Connect (OIDC), SAML 2.0, SCIM 2.0, FIDO2/WebAuthn, and Kerberos.
Architectural expertise across enterprise identity providers such as Microsoft Entra ID and Okta; IGA platforms such as SailPoint IdentityIQ or Identity Security Cloud; and PAM solutions such as CyberArk or HashiCorp Vault.
Demonstrated success leading identity discovery, tenant consolidation, and domain migration workstreams across complex, multi-entity corporate structures.
Comprehensive familiarity with SOX 404 ITGC controls, the HIPAA Security Rule, and international data-sovereignty frameworks.
Exceptional executive communication and stakeholder diplomacy, with the ability to translate cryptographic and identity concepts into clear business risk decisions.
Ability to manage multiple priorities and meet tight deadlines in a fast-paced M&A environment.
Adaptability to evolving IAM technologies and security threats.

Nice To Haves

At least 5 years operating as a Lead or Principal Enterprise IAM Architect within a Fortune 500 or hyper-scale enterprise.
Experience with Microsoft Entra ID, Okta, Ping, SailPoint IdentityIQ or Identity Security Cloud, CyberArk, and HashiCorp Vault.
Experience with Workday, SuccessFactors, or PeopleSoft HRMS integrations.
Experience with Active Directory, ADFS, GCP, AWS, Azure/Entra ID, and SaaS identity ecosystems.
Experience developing SailPoint connectors for Active Directory, JDBC, and REST/SOAP web services.
Experience with CIEM, NHIM, ISPM, agentic/AI security controls, FIDO2 smart cards, RFID badge authentication, and shared kiosk sessions.

Responsibilities

Architect repeatable IAM blueprints for mergers, acquisitions, and divestitures, with the goal of reducing subsidiary integration timelines from months to weeks.
Lead IAM technical workstreams, identity discovery, user and attribute migration, and system consolidation for newly acquired business entities.
Consolidate disparate identity providers and enterprise directories into a unified enterprise SSO platform; design cross-domain authentication, federation, cross-cloud collaboration, and tenant-boundary governance.
Define enterprise IAM architecture standards, technical standards, architectural patterns, and reference blueprints for SSO, IGA, and directory services.
Evaluate third-party integration patterns and vendor Statements of Work for complex migrations, and establish technical decommissioning strategies for legacy identity platforms.
Design and govern secure identity bridges between on-premises infrastructure, multi-cloud environments, and SaaS ecosystems.
Define ZSP and JIT access patterns using PAM and CIEM capabilities to reduce on-premises and cloud attack surfaces.
Research and evaluate NHIM, ISPM, and agentic or AI security controls for the long-term IAM roadmap.
Ensure identity systems scale to support business expansion, M&A activity, and digital healthcare operations.
Design authoritative-source integrations with HRMS platforms to drive identity lifecycle processes.
Develop policy-driven access models and automated SoD frameworks aligned with SOX ITGC, HIPAA, and GDPR requirements.
Architect frontline authentication solutions, including contactless RFID badge tap-and-go, biometric FIDO2 smart cards, and shared kiosk sessions.
Design self-service capabilities that enable people leaders to monitor and right-size direct-report access.
Partner with IAM Engineering to establish self-healing provisioning patterns targeting 99.999% core availability.
Design, develop, and configure SailPoint connectors for Active Directory, JDBC, and REST/SOAP web services.
Configure and maintain birthright provisioning to provide immediate, policy-driven access for new joiners.
Automate joiner, mover, and leaver lifecycle events and request-based provisioning workflows.
Expand CIEM to discover and eliminate over-privileged assignments continuously.
Develop automated workflows and API-driven automations for onboarding, transitions, offboarding, and provisioning.
Implement infrastructure-as-code principles for IAM configurations.
Design, implement, and maintain SSO, identity lifecycle management, IGA, and PAM solutions.
Ensure IAM systems and processes comply with regulatory requirements and internal security policies, maintaining auditable access records and protecting sensitive information.
Coordinate IAM implementation with Information Security, IT Operations, HR, and Application Development; communicate complex security concepts to technical and non-technical stakeholders.
Develop and maintain architecture diagrams, configuration guides, operational procedures, and other technical documentation.
Stay current with IAM best practices, regulatory requirements, technologies, and security trends.
Recommend new practices, processes, metrics, or models; lead complex projects; and mentor less experienced colleagues.