Advanced Security Engineer (IAM)

Remote

Job Overview

The Advanced IAM Engineer is a technically deep, hands-on practitioner who forms the operational backbone of the enterprise IAM function. Treating identity as the primary control plane in a defense-in-depth program, this engineer designs, deploys, and optimizes AI-enabled identity technologies across the workforce, customer, and non-human (machine and agent) identity domains. Partnering with the Manager of Enterprise Security and cross-functional teams, the role reduces Relativity's identity attack surface and improves detection and response times for identity-based threats.

Role Responsibilities

Job Description and Requirements

Continuous Adaptive Trust & Identity Operations

• Implement and operate identity controls spanning workforce, machine, and workload identity as part of a layered defense-in-depth model.
• Operate continuous adaptive trust mechanisms, including continuous access evaluation (CAE), risk-based step-up authentication, and session revocation, that re-verify identity against real-time posture and behavioral signals rather than at the access gate alone.
• Configure ZTNA, least-privilege access, phishing-resistant MFA/FIDO2, and JIT access across access paths.
• Implement SSO, federation, and authentication standards (SAML, OAuth 2.0, OIDC, SCIM, Kerberos, LDAP) across SaaS and multi-cloud environments.
• Apply hardening standards to identity infrastructure using CIS Benchmarks/DISA STIGs with automated compliance validation.

• Build and maintain identity lifecycle automation (joiner/mover/leaver) integrating HR systems, directories, and downstream applications.
• Operate identity governance and administration (IGA) workflows: access reviews, certification campaigns, and segregation-of-duties checks.
• Administer privileged access management (PAM) including credential vaulting, JIT elevation, and session monitoring.
• Maintain governance of non-human identities (service accounts, workloads, secrets) using drift detection and policy-as-code.

• Feed identity telemetry into the detection stack (SIEM/SOAR, UEBA) to support detection of credential abuse, privilege escalation, and lateral movement.
• Execute identity-focused IR playbook steps for account takeover, credential compromise, and session hijacking.
• Implement identity checks in CI/CD pipelines (secret scanning, IaC identity analysis), acting on AI-generated fix recommendations in PR workflows.
• Track identity hygiene metrics and support audits, certifications, and e-discovery requirements alongside GRC.

• Bachelor's in Computer Science, Information Security, or equivalent experience.
• 5+ years of hands-on experience in enterprise IAM or security engineering, with a focus on identity, authentication, and access domains, or a Master's degree in Cybersecurity or a relevant field.
• Hands-on experience with common identity tools such as IdP/SSO (Okta, Entra ID/Azure AD, Ping), IGA (SailPoint, Saviynt), PAM (CyberArk, BeyondTrust), and directory services, plus intermediate knowledge of authentication and federation protocols (SAML, OIDC, OAuth 2.0, SCIM, LDAP, Kerberos).
• Basic knowledge of industry-standard security benchmarks and frameworks (MITRE, NIST 800-63, Zero Trust).
• Proficiency in at least one scripting/automation language (Python, Bash, or PowerShell) applied to modern containerized services, CLI-based commands, and/or identity-specific use cases (API-driven provisioning, policy-as-code).
• Ability to communicate technical findings clearly to both engineering peers and non-technical stakeholders.

• Familiarity with AI-enabled identity operations (UEBA, ML-based access-risk scoring, or AI-assisted access-review and threat-hunting workflows).
• Basic knowledge of common cloud environments (AWS, Azure, or GCP) and their native identity services (IAM, RBAC, workload identity).
• Working knowledge of the software development lifecycle, software engineering practices, or infrastructure-as-code environments: contributing identity and access controls (secrets management, workload identity, policy-as-code) to CI/CD pipelines.
• Experience with non-human, workload, and AI-agent identity, secrets management, and machine-to-machine authentication.
• Experience supporting compliance and audit requirements (SOC 2, ISO 27001, FedRAMP, HIPAA) from an identity and access control perspective.
• Relevant certifications such as SC-300 (Microsoft Identity and Access Administrator), AZ-500 (Azure Security Engineer), Okta Certified Professional/Administrator, SailPoint IdentityIQ, SEC+, CISSP, CISA, or equivalent.

This position is eligible for total compensation which includes a competitive base salary, an annual performance bonus, and long-term incentives.

The expected salary range for this role is between following values:

$104 000 and $156 000

The final offered salary will be based on several factors, including but not limited to the candidate's depth of experience, skill set, qualifications, and internal pay equity. Hiring at the top end of the range would not be typical, to allow for future meaningful salary growth in this position.

Required Skills

Endpoint Security, Network Security, Penetration Testing, Security Architecture Design, Security Automation, Security Information, Security Information and Event Management (SIEM), Security Operations, Threat Modeling, Vulnerability Management