BCBSMA
Lead IAM Engineer
Boston · Full-time
Sponsorship not specified$164k-$200kDetected 13 days ago
PythonPowerShellAWSGCPAzureCloud PlatformsTerraformCI/CDOAuthCybersecurityZero TrustMentoringCISSP
About the role
- We may ultimately pay more or less than the posted range, and the range may be modified in the future.
- This job is also eligible for variable pay.
Responsibilities
- Design and implement IAM solutions across SSO, MFA, IGA, PAM, and cloud identity platforms.
- Build integrations between IAM platforms and enterprise applications.
- Support onboarding applications into IAM services.
- Create reference architectures and design patterns.
- Develop enterprise standards for authentication, authorization, and privileged access.
- Support Zero Trust initiatives.
- Develop automation using Python, PowerShell, Terraform, APIs, and workflow engines.
- Lead troubleshooting of complex authentication and provisioning failures.
- Perform root cause analysis and remediation.
- Conduct design reviews and code reviews.
Requirements
- High school degree or equivalent required unless otherwise noted above
- Expert-level knowledge of modern identity protocols (SAML, OAuth 2.0, OpenID Connect).
- Advanced, hands-on experience engineering leading platforms (e.g., Ping, Delinea, SailPoint, Entra ID) for enterprise-wide scale.
- Deep expertise in automating Identity Governance (JML processes) and deploying modern PAM controls (credential vaulting, Just-in-Time access).
- Strong proficiency in scripting/automation (Python, PowerShell, Terraform).
- Demonstrated experience leading complex IAM initiatives supporting hybrid, multi-cloud, and SaaS environments.
Nice to have
- Bring your true colors to blue.
- The ideal candidate combines deep technical expertise with architectural thinking and hands-on engineering execution.
- This role is eligible for our Flex persona, with candidates local to our Boston, MA or Hingham, MA offices preferred.
- Bachelor's in CS/Engineering preferred, with 8+ years of dedicated IAM engineering experience.
- Relevant industry certifications (e.g., CISSP, CISM, CCSP, or vendor-specific IAM certs) are strongly preferred
Skills
- Secures complex federated identities, APIs, and non-human workload identities across multi-cloud environments (AWS, Azure, GCP).
Compensation
- $163,530.00 - $199,870.00
- The job posting range is the lowest to highest salary we in good faith believe we would pay for this role at the time of this posting.
- We may ultimately pay more or less than the posted range, and the range may be modified in the future.
- This job is also eligible for variable pay.
- An employee's pay position within the salary range will be based on several factors including, but limited to, relevant education, qualifications, certifications, experience, skills, performance, shift, travel requirements, sales or revenue-based metrics, and business or organizational needs and affordability.
- Note: No amount of pay is considered to be wages or compensation until such amount is earned, vested, and determinable.
Benefits
- It's in our differences that we will remain relentless in our pursuit to transform healthcare for ALL.
Company info
- As an employer, we are committed to investing in your development and providing the necessary resources to enable your success.
- Learn how we are dedicated to creating an inclusive and rewarding workplace that promotes excellence and provides opportunities for employees to forge their unique career path by visiting our Company Culture page.
- If this sounds like something you'd like to be a part of, we'd love to hear from you.
This listing is sourced directly from BCBSMA's careers page and normalized into a canonical job model.