Senior Workforce IAM Engineer

College Board – Technology – Workforce IAM

Location: This is a remote role. Candidates who live near CB offices have the option of being fully remote or hybrid (Tuesday and Wednesday in office). All CB employees are required to occasionally travel to meet in person for business purposes.

Role Type : This is a full-time position

About the Team

The Workforce Identity and Access Management (WIAM) team is the identity control plane for College Board's enterprise. The team owns the full workforce identity lifecycle, from onboarding and provisioning through access governance, certification, and offboarding, and operates the platforms that enforce authentication, authorization, and privileged access management across the organization.

WIAM's work spans six capability pillars: identity onboarding, provisioning, authentication and authorization, credential management, governance and compliance, and identity offboarding. Each pillar has a named engineer accountable for its maturity, its roadmap, and the controls that run inside it. The team is the primary owner of College Board's enterprise IGA platform and PAM infrastructure, and it partners closely with Talent, ISGRC, and security peer teams to ensure identity services are reliable, auditable, and aligned to Zero Trust principles.

The team operates at the intersection of security rigor and user experience; the controls WIAM builds directly affect how every College Board employee accesses systems and data every day. As College Board's workforce has grown and its cloud and SaaS footprint has expanded, WIAM's scope has grown to match: centralizing more applications, automating more lifecycle actions, and governing an increasingly complex mix of human and non-human identities.

About the Opportunity

As a Senior Engineer on the WIAM team, you are a hands-on identity engineer who owns the Governance and Compliance pillar and is accountable for it meeting its goals. The pillar covers the governance of access and identities in the IGA platform across human, service, and AI agent identities (currently in the building phase), including access reviews, security attestations, account reviews, least-privilege enforcement, segregation of duties, and account ownership and accountability. You ensure the access sent to reviewers is accurate and understandable, that reviews run on schedule, and that each produces clear, auditable evidence. While each review has an owner, you administer and facilitate how it is implemented, advising on feasibility, scheduling, notifications and communications, the evidence produced, and what the platform can give the reviewers. You are directly involved in how AI agents are integrated into the IGA platform, so they meet the same level of accountability through defined owners, lifecycle states, and reviewable access, while minimizing business impact when access is removed.

You also work as part of our broader WIAM team, where all engineers share the workload across our applications (AD, Entra ID, Okta OIG, CyberArk, and 1Password). That work includes access provisioning, identity management, setting up applications and integrations, building and maintaining automations (PowerShell, Okta Workflows, ADManager Plus, and other automation tools), maintaining vaults in CyberArk, and various other tasks. You bring a governance lens to all of it, asking what internal and external auditors will want from each process and making sure it is there. The controls you build shape how every College Board employee reaches the systems and data they need to serve students.

In this role, you will:

Facilitate Certifications, Attestations, and Governance (35%)

Plan and forecast the year's review cycle in Okta, including annual recurring reviews and new work, while balancing other teams' capacity against compliance and external audit deadlines

Design, configure, launch, monitor, and close access reviews, account reviews, and security attestations in Okta across human, service, and AI agent identities, scoped so reviewers can make considered decisions while reducing review fatigue

Bring new account types into the recurring review cycle as they come into scope

Run the annual user access review cycle end to end, from scoping and reviewer assignment through remediation, closure, and delivery of the auditor reporting package against the use cases agreed upon with the audit owner

Fulfill evidence requests from internal College Board groups and external auditors by the agreed due date

Verify requirements and review data before launch, and bring any issues you spot to the review owner

Maintain the job guides and documentation that let another engineer run a review cycle correctly without you

Partner with Security, Risk, Audit, Technology and business teams to translate security, compliance and technical requirements into workable identity controls

Keep WIAM's practices aligned to College Board information security policy, tracking policy changes and flagging where team practice needs to move

Build and Enforce AI Governance (25%)

Integrate AI agent identities into the IGA platform as they come online, with defined owners, lifecycle states, and reviewable access

Define the ownership model for AI agents: who is accountable for an agent's access, and what happens when its purpose or owner changes

Bring AI agent identities under access review and least-privilege enforcement on the same cycle as human and service accounts

Govern the access AI tools and agents hold to College Board systems and data: what each can reach, who approved it, how it is reviewed, and how to revoke it

Build and run the attestation flows for AI tools as the organization adopts them, reusing patterns rather than rebuilding per tool

Partner with AI governance stakeholders and Risk Engineering so identity controls for agents are designed once and land in the right place

Build & Run Identity Services with Security in Mind (40%)

Work alongside the team on day-to-day identity engineering, including onboarding, offboarding, and access requests, asking what internal and external auditors will want from each and making sure it is there

Direct and review governance pillar work carried out by other engineers on the team, remaining accountable for the outcome

Establish and maintain account ownership and accountability across identity types: named owners and defined lifecycle states for human, service, and workload identities, extending to API identities as they come into scope

Enforce least privilege with exceptions documented and tracked

Monitor and correct any unintended changes between approved and actual entitlements across centralized applications

Automate enforcement and evidence with Okta Workflows and platform APIs

Measure the team's controls against recognized industry frameworks such as NIST, identify gaps, and propose how to close them

Report on the enforcement of the pillar's controls with documented, traceable data

Analyze access and entitlement data to support troubleshooting, audits, and continuous improvement

Participate in the team's on-call rotation, responding to identity platform incidents and following established escalation procedures

About You

To qualify for this role, you must have:

5+ years of identity and access management and/or security engineering experience, including hands-on work with Active Directory, Entra ID, and Okta

Experience designing and running access reviews, certifications, or attestation campaigns at scale, including scoping, reviewer assignment, remediation, and closure, and delivering the evidence to internal or external auditors

Working knowledge of policy and compliance frameworks such as NIST, and the judgment to translate framework guidance into practical control requirements

Hands-on production experience with Okta, especially Okta Identity Governance and Okta Workflows

Experience with agentic AI governance: tr