IT IAM Engineer

Role overview Own the identity and access systems that determine who can use company tools, under what conditions, and for how long. You’ll administer identity platforms, automate access changes, and turn security and compliance policies into practical technical controls.

Responsibilities - Manage user accounts, groups, role assignments, and dynamic membership in an identity provider. - Set access policies based on factors such as device compliance, identity risk, and location; maintain strong authentication and retire legacy methods. - Automate onboarding, role changes, and offboarding, and connect business applications through SSO and account provisioning. - Run access reviews, manage privileged access, and govern service accounts, application permissions, API credentials, and secrets. - Document access controls and compliance evidence, and work with security and endpoint teams on policy, threat detection, and account incidents.

Requirements - Experience administering a modern identity platform, including user lifecycle, groups, and conditional or context-aware access. - Experience implementing SSO and account provisioning integrations using SAML and SCIM. - Ability to automate work through scripting or APIs across identity and SaaS platforms. - Strong documentation skills and the ability to turn written policies into enforceable controls. - Clear communication skills, including explaining access decisions to non-technical colleagues and gaining support.

Nice to have Experience owning identity systems at a growing organization; applying zero trust principles; running access reviews or privileged access programs; governing service accounts and OAuth permissions; supporting NIST, ISO 27001, SOC 2, or similar frameworks; or investigating identity threats and compromised accounts.

Benefits and work setup This is a full-time role with a stated salary range of $120,000–$180,000, equity, flexible paid time off, health, dental, vision, and disability coverage, tax-advantaged savings accounts, and possible relocation assistance. The position is intended to be on-site in Portland, Oregon; remote candidates are expected to visit the office at least one week each quarter. Occasional after-hours work may be needed for migrations, access changes, or incident response.