Senior Identity and Access Management Engineer

About the Role

As an Identity and Access Management (IAM) Engineer, you will play a critical role in ensuring the security and integrity of our systems, data, and applications. You will be responsible for designing, implementing, and managing IAM solutions that control access to sensitive resources and protect against unauthorized access. This includes developing and maintaining IAM policies, procedures, and standards, as well as integrating IAM systems with other security and IT infrastructure components. You will collaborate with cross-functional teams to understand their access needs and implement solutions that meet those needs while adhering to security best practices. Additionally, you will be responsible for monitoring IAM systems, identifying and resolving security incidents, and providing technical support to end-users. This role requires a strong understanding of IAM principles, technologies, and industry standards, as well as excellent problem-solving and communication skills. You will also stay up-to-date on the latest security threats and vulnerabilities and proactively implement measures to mitigate those risks.

Core Objective

The primary objective of this role is to establish and maintain a robust and effective IAM program that aligns with the organization's security policies and business objectives. This includes implementing and managing IAM solutions that provide secure and seamless access to resources for authorized users while preventing unauthorized access. You will be responsible for developing and maintaining IAM policies, procedures, and standards and ensuring compliance with relevant regulations and industry best practices. Additionally, you will work to improve the efficiency and effectiveness of IAM processes through automation and optimization. You will also monitor IAM systems, identify and resolve security incidents, and provide technical support to end-users. This role requires a proactive approach to security, a strong understanding of IAM principles and technologies, and the ability to collaborate effectively with cross-functional teams.

Ultimately, your success in this role will be measured by the effectiveness of the IAM program in protecting the organization's assets and enabling business operations.

Core Responsibilities

1. Account Management:
2. Define allowed account types and review annually.
3. Disable accounts when expired, no longer associated with a user, or inactive for more
4. than 30 days.
5. Enable inactivity logout after 15 minutes of inactivity.
6. Identify privileged user accounts and monitor/log changes quarterly.
7. Monitor accounts for atypical use and report within 30 minutes of discovery.
8. Disable high-risk accounts within 30 minutes of discovery.

Access Enforcement:

1. Require multi-factor authentication for privileged and remote access accounts.
2. Enforce minimum password lengths & password complexity
3. Enforce role-based access control for non-privileged user accounts.
4. Revoke access authorizations based on security attribute changes at runtime.
5. Require centralized/domain authentication

Information Flow Enforcement:

1. Implement dynamic information flow controls based on changing conditions.
2. Implement flow control of encrypted information (decrypt, block, or terminate sessions).
3. Remove harmful information when transferring data between security domains.
4. Separation of Duties:
5. Separate implementation and audit responsibilities.

Least Privilege:

1. Implement non-privileged accounts for users with privileged accounts accessing non-security functions.
2. Restrict privileged accounts to users with a documented need.
3. Routinely review privileges quarterly or as necessary.
4. Require security domain-specific authentication.
5. Implement enhanced monitoring of privileged accounts and service accounts.

Session Management:

1. Implement automatic account lockout after a defined number of invalid login attempts.
2. Concurrent Session Control:
3. Limit the number of concurrent sessions for each account type.
4. Enforce inactivity timer to initiate device lock after inactivity.
5. Promote user-initiated logouts.
6. Enforce session inactivity logout with an explicit message.

Remote Access:

1. Restrict remote access through authorized and managed network access control points.
2. Implement enhanced monitoring and control of remote access methods.
3. Require encryption for remote access sessions.
4. Disconnect or disable remote access within 15 minutes of detecting atypical behavior.
5. Disable unused wireless components.
6. Require authentication and encryption for wireless access.
7. Implement enhanced monitoring at all wireless access points.
8. Limit access to protected information on unauthorized mobile devices.
9. Control mobile device configurations remotely.
10. Enforce full-device encryption.

Qualifications

1. Bachelor's degree in computer science, cybersecurity, or a related field.
2. 3 + years of experience in endpoint security engineering or a related role.
3. Strong understanding of endpoint security technologies like Active Directory, Azure AD,
4. Single Sign On, and IAM observability.
5. Experience with security policy development and enforcement.
6. Knowledge of IAM testing techniques.
7. Experience with incident response and remediation.
8. Familiarity with security frameworks and standards, such as NIST, ISO, and CIS.
9. Excellent analytical and problem-solving skills.
10. Strong communication and interpersonal skills.

Success Metrics

1. Reduction in identity related security incidents
2. Improved identity and access management security posture
3. Compliance with security policies and regulations
4. Effective incident response and remediation
5. Positive feedback from stakeholders

Working Relationships

1. Reports to: Manager of Cybersecurity Engineering and Risk Management
2. Direct Reports: None
3. Collaborates with: Customer Experience Team, Project Management Team, Cybersecurity Engineering Team