Identiy and Access Management Engineer

Easterseals Southern California transforms lives every day. For over a century, Easterseals has championed inclusion and independence—delivering essential services like early childhood programs, autism services, employment and independent living support to more than 29,000 people each year. Through advocacy and education, we break barriers and create opportunities for the one-in-four Americans with disabilities.

The Identity & Access Management (IAM) Engineer is the senior technical owner of identity services in a regulated healthcare environment, responsible for designing, implementing, and operating secure access controls for systems handling Protected Health Information (PHI). The role leads identity lifecycle management, authentication and authorization, application integration, privileged access management, and identity governance across Active Directory, Okta, and Microsoft Entra ID. Working independently, the IAM Engineer defines identity standards, access control models, and integration patterns; reduces privileged access risk through PAM and just-in-time access; and serves as the senior escalation point for authentication and federation issues. The role partners with IT Security leadership to ensure identity controls align with HIPAA, HITRUST, and internal security requirements. In all responsibilities, the position demonstrates a strong commitment to ESSC’s mission and values by supporting a safe, compliant, and responsive workplace injury management process.

Hiring Salary Range: $101k - $126k / yr.

OVERVIEW

The Identity & Access Management (IAM) Engineer is the senior technical owner of identity services in a regulated healthcare environment, responsible for designing, implementing, and operating secure access controls for systems handling Protected Health Information (PHI). The role leads identity lifecycle management, authentication and authorization, application integration, privileged access management, and identity governance across Active Directory, Okta, and Microsoft Entra ID. Working independently, the IAM Engineer defines identity standards, access control models, and integration patterns; reduces privileged access risk through PAM and just-in-time access; and serves as the senior escalation point for authentication and federation issues. The role partners with IT Security leadership to ensure identity controls align with HIPAA, HITRUST, and internal security requirements. In all responsibilities, the position demonstrates a strong commitment to ESSC’s mission and values by supporting a safe, compliant, and responsive workplace injury management process.

ESSENTIAL FUNCTIONS

Own Okta as the primary identity platform — SSO, MFA and adaptive authentication policy, lifecycle management, and SaaS application access — and advance the organization toward passwordless, phishing-resistant authentication (FastPass, FIDO2/WebAuthn, certificate-based authentication).

25%

Engineer identity integrations using SAML, OIDC/OAuth 2.0, and SCIM, including claims and expression logic, attribute mapping, and non-standard vendor implementations.

25%

Design and implement Okta lifecycle workflows automating joiner, mover, and leaver processes from Workday through Okta, Entra ID, Active Directory, and downstream applications.

25%

Own the enterprise Privileged Access Management platform, including credential vaulting and rotation, session management and session recording, and secrets management.

25%

Total

100%

Follows applicable laws, regulations, policies, and procedures, and reports potential compliance or risk concerns through appropriate channels. Uses time, materials, equipment, and other resources responsibly and efficiently. Performs other duties as assigned.

QUALIFICATIONS, EDUCATION, EXPERIENCE

Required Minimum Education

Bachelor’s degree in Information Technology, Information Security, or a related field, or equivalent practical experience.

Preferred Education

None

Required Certifications or Licenses

None

Minimum Experience

7+ years in Identity & Access Management or a closely related information security role, including demonstrated ownership of identity platform design and implementation.

KNOWLEDGE, SKILLS, ABILITIES

· Demonstrated technical expertise architecting, securing, and troubleshooting Okta — SSO, MFA and adaptive authentication policy, passwordless and phishing-resistant authentication, lifecycle management, and Okta Workflows.

· Demonstrated technical expertise architecting, securing, and troubleshooting Active Directory and Microsoft Entra ID — hybrid identity synchronization, OU and delegation models, Kerberos and LDAP authentication flows, AD replication and FSMO troubleshooting, and privileged tier models with administrative account separation.

· Demonstrated technical expertise architecting, securing, and troubleshooting enterprise PAM platforms (Delinea, BeyondTrust, CyberArk, or equivalent) — credential vaulting and rotation, session management, secrets management, and just-in-time privileged access.

· Proven ability to build and troubleshoot identity integrations using SAML, OIDC/OAuth 2.0, and SCIM 2.0, including attribute and schema mapping and non-standard vendor implementations.

· Scripting and automation proficiency (PowerShell and/or Python) against identity APIs such as Microsoft Graph and Okta.

· Applied expertise in identity lifecycle management (ILM), role-based access control (RBAC), least-privilege and separation-of-duties principles, and modern authentication including phishing-resistant and passwordless methods.

· Experience designing and enforcing device-based access controls, including device trust and compliance as authentication signals.

· Experience securing access to cloud and enterprise healthcare applications in a regulated environment.

· Strong attention to detail and documentation discipline, with the ability to produce audit-defensible standards, designs, and procedures.

Must successfully pass and maintain all required background screenings, fingerprint clearances, and drug testing in accordance with Easterseals Southern California and program requirements.

JOB DIMENSIONS

No. of Direct Reports

0

No. of Indirect Reports

0

Financial Dimensions

No direct budget or revenue responsibility. Role has significant operational impact through administration of identity platforms, privileged access controls, access governance, and secure system integrations supporting enterprise applications and systems containing PHI. May influence vendor/application access decisions, security tool utilization, and risk mitigation efforts.

Expected Decisions

Determines appropriate identity architecture, access control models, authentication methods, and integration approaches for enterprise applications. Makes technical decisions related to SSO, MFA, lifecycle management, PAM, role-based access controls, and privileged access risk reduction. Evaluates and resolves complex authentication, federation, provisioning, and access issues; escalates significant security, compliance, or business-impacting concerns to IT Security leadership as appropriate.

Key Performance Indicators

Reliability, accuracy, and effectiveness of identity lifecycle management, provisioning, deprovisioning, and access control processes. Timely resolution of complex IAM incidents, authentication issues, and access-related escalations. Successful implementation and maintenance of secure identity integrations, MFA/passwordless authentication, PAM controls, and least-privilege access standards. Audit readiness and quality of documentation supporting HIPAA, HITRUST, and internal security requirements. Reduction of privileged access risk and improvement of identity governance practices.

Communications & Working Relationships

Works closely with IT Security leadership to align identity controls with security, compliance, and risk requirements. Partners with IT, HRIS/Workday, application owners, vendors, and busin