Cybersecurity IAM Engineer (SailPoint IdentityIQ & Identity Security Cloud)

Quick Facts

• Role: Cybersecurity IAM Engineer (SailPoint IdentityIQ and Identity Security Cloud)
• Work model: Hybrid (2 days remote, 3 days on site)
• Duration: Long term

Description

This role designs, engineers, and modernizes enterprise identity governance capabilities across hybrid cloud and on-prem environments. You will blend SailPoint IdentityIQ and Identity Security Cloud development with IAM architecture leadership, lifecycle automation, integrations (including ServiceNow), and governance frameworks aligned with Zero Trust principles.

Responsibilities

• Design, implement, and maintain SailPoint IdentityIQ (IIQ) and Identity Security Cloud (ISC) solutions
• Develop and automate workflows, connectors, and application onboarding
• Administer and support Microsoft Entra ID (Azure AD), including Privileged Identity Management (PIM)
• Integrate IAM systems with AWS, Azure, and/or Google Cloud Platform
• Implement and manage Okta solutions, focused on Citizen IAM and external user identity needs
• Perform code reviews, remediate IAM vulnerabilities early, and optimize system logic
• Collaborate with IT stakeholders and business owners to mature RBAC and onboarding programs
• Integrate APIs, PAM tools, SailPoint Access History, SailPoint Access Modelling, and database platforms
• Test, deploy, patch, and recommend upgrades for IAM systems
• Lead migration from IIQ to ISC for an upcoming initiative

SailPoint IdentityIQ Engineering & Development

• Develop and maintain BeanShell rules, custom workflows, lifecycle event logic, task definitions, and plugin modules
• Engineer custom connectors, aggregation jobs, reconciliation logic, and provisioning adapters
• Build application onboarding frameworks, entitlement schemas, and role models
• Optimize certification campaigns, policy enforcement, SoD controls, and governance reporting
• Extend IIQ using Java, REST APIs, SCIM, and custom UI components

IAM Architecture & Solution Design

• Define and maintain end-to-end IAM architecture (identity sources, directories, governance layers, provisioning flows)
• Architect joiner/mover/leaver lifecycle automation with authoritative source alignment and attribute-driven access
• Design SailPoint IIQ ↔ ServiceNow integration patterns for access requests, ticket workflows, provisioning orchestration, and governance routing
• Establish RBAC/ABAC frameworks, role mining, and access modeling standards
• Create architectural diagrams, data flow maps, and governance models
• Evaluate modernization options (e.g., SailPoint SaaS, passwordless, adaptive risk, ServiceNow IAM modules)
• Lead design reviews, threat modeling sessions, and IAM roadmap planning with cybersecurity leadership

Integration & Directory Services

• Architect integrations with Active Directory, LDAP, Azure AD/Entra ID, HR systems, cloud applications, and ServiceNow
• Develop REST/SOAP integrations, SCIM connectors, and custom provisioning logic
• Implement SAML, OAuth, OIDC, and MFA authentication/federation patterns
• Ensure directory hygiene, identity data quality, and lifecycle accuracy across systems

ServiceNow Integration & Workflow Engineering

• Design and maintain ServiceNow IAM workflows for access requests, approvals, and fulfillment automation
• Integrate SailPoint IIQ with ServiceNow for ticket-based provisioning/deprovisioning, incident creation on failures, and change management alignment
• Optimize downstream orchestration between ServiceNow and SailPoint for speed, accuracy, and auditability
• Support migration/redesign when ServiceNow is used as a front end for IAM services

Security Engineering & Governance

• Apply Zero Trust, least privilege, RBAC/ABAC, and governance principles to all IAM designs
• Engineer automated controls supporting SOX, HIPAA, ISO 27001, and NIST compliance
• Run root cause analysis for provisioning failures, connector issues, workflow errors, and performance bottlenecks
• Partner with security architects to align IAM architecture with enterprise cybersecurity strategy

Operational Support & Platform Stability

• Support production IIQ environments (break/fix, patching, upgrades, and performance tuning)
• Maintain technical documentation, architectural diagrams, and operational runbooks
• Collaborate with HRIS, infrastructure, ServiceNow, and application teams to improve lifecycle reliability

Requirements

• 5–9 years in IAM engineering, with 5–10+ years of SailPoint IdentityIQ development
• Strong proficiency in Java, BeanShell, XML, JSON, SQL, and REST API development
• Deep understanding of IIQ object model, connector frameworks, workflow engine, and plugin architecture
• Hands-on experience architecting SailPoint IIQ integrations with ServiceNow
• Strong knowledge of directory services, identity stores, and authentication protocols
• Experience supporting Microsoft Entra ID (Azure AD) and Privileged Identity Management (PIM)
• Expertise in identity governance concepts (RBAC/ABAC, SoD, and policy enforcement) and familiarity with NIST
• Experience with IAM modernization, including migration from IIQ to ISC