MUST HAVE SAILPOINT AND & BEYONDTRUST EXPERIENCE. Senior Identity & Access Management (IAM) Engineer Role Overview City of Hope is seeking an elite, highly technical Senior IAM Engineer to architect, secure, and operate our enterprise identity infrastructure [1, 2]. This role is a critical position focused on modernizing our hybrid identity footprint, enforcing zero-trust architecture, and securing privileged access. The ideal candidate possesses deep, hands-on engineering mastery across the Microsoft Entra ID suite, SailPoint Identity Governance, Active Directory, and BeyondTrust PAM [3, 4]. You will be responsible for eliminating identity risk, automating the Joiner-Mover-Leaver (JML) lifecycle, and providing high-confidence identity security across our healthcare and research networks [2]. Core Technical Stack • Identity Platforms: Microsoft Entra ID (Azure AD), Active Directory (AD) [3]. • Identity Governance (IGA): SailPoint [3, 4]. • Privileged Access Management (PAM): BeyondTrust [4]. • Protocols & Standards: SAML, OIDC, OAuth 2.0, Kerberos, LDAP, KQL. Key Responsibilities Microsoft Entra ID & Hybrid Identity Operations • Tenant & Core Identity: Maintain Entra ID tenant architecture, service accounts, directory roles, and emergency break-glass account governance. • Hybrid Identity & Synchronization: Manage Entra Connect and Cloud Sync topologies, resolve complex attribute authority matching issues, and monitor global synchronization health. • Groups & RBAC: Define enterprise security group standards, engineer dynamic assignment rules, and build scalable Role-Based Access Control (RBAC) and least-privilege authorization models. Authentication, Access Control & Application Identity • MFA & Passwordless: Design and enforce MFA policies, authentication methods, passwordless configurations (FIDO2, Temporary Access Pass/TAP), and manage exception architectures. • Conditional Access (CA): Architect and troubleshoot advanced, risk-based Conditional Access strategies tracking application, network, and device postures. • SSO & Application Integration: Own the full lifecycle of application registrations, enterprise apps, OAuth consent workflows, SAML/OIDC configurations, and token claims mapping. Privileged & Governance Controls (SailPoint & BeyondTrust) • Identity Governance (IGA): Partner to optimize automated SailPoint Joiner-Mover-Leaver (JML) lifecycle workflows, access packages, entitlement management, separation of duties (SoD), and user access reviews. • Privileged Access Management (PAM): Architect and configure BeyondTrust and Entra Privileged Identity Management (PIM) to enforce Just-In-Time (JIT) access, admin role approvals, and privileged session auditing. • External Identity (B2B): Enforce guest user lifecycle configurations, cross-tenant synchronization, external vendor access reviews, and naming standards. Identity Security, Compliance & Incident Response • Security Monitoring: Leverage Entra Identity Protection and Microsoft Sentinel integrations to proactively triage identity alerts and anomalies. • Compliance & Auditing: Respond to identity-centric incident escalations, gather evidence for regulatory audits, and author Standard Operating Procedures (SOPs). Required Qualifications • Experience: 7+ years of dedicated Identity and Access Management (IAM) engineering experience within an enterprise environment. • Platform Mastery: Proven hands-on engineering experience configuring and maintaining Microsoft Entra ID (Azure AD) and on-premises Active Directory [3]. • Governance Tools: Deep technical experience interacting with SailPoint for identity lifecycle automation and access governance [3, 4]. • Privileged Infrastructure: Hands-on experience operating BeyondTrust or Entra PIM for privileged credential vaulting and session management [4]. • Automation: Strong scripting capabilities (PowerShell, Microsoft Graph API) to automate administrative identity tasks. • Education: Bachelor’s degree in Computer Science, Information Security, or equivalent professional experience. Preferred Certifications • Microsoft Certified: Identity and Access Administrator Associate (SC-300) • Microsoft Certified: Azure Administrator Associate (AZ-104) • Certified Information Systems Security Professional (CISSP) • SailPoint Certified IdentityNow/IdentityIQ Engineer or BeyondTrust Certified Engineer [4]