Sr IAM Cloud Engineer

HealthEquity is a company dedicated to saving and improving lives by empowering healthcare consumers. They are seeking a Senior IAM Cloud Engineer to design, secure, and operate AI-driven systems in cloud environments, focusing on identity and access management and cloud security.

Responsibilities:

• Design, implement, and maintain IAM frameworks (SSO, MFA, RBAC, PAM) across multi-cloud environments (AWS, Azure, GCP). Harden cloud environments using IAM policies, KMS, WAF, GuardDuty, Defender for Cloud, and compliance tools. Automate identity lifecycle management, provisioning, and deprovisioning
• Define and standardize IAM cloud access structures and secure cloud configurations. Build detection pipelines, automate compliance checks, and integrate CEIM tools
• Support the secure use of Generative AI capabilities within IAM environments, including use cases related to access analysis, anomaly detection, issue summarization, remediation recommendations, and operational workflow automation
• Contribute to the design, testing, and refinement of AI-enabled IAM tools, prompts, retrieval strategies, and automation workflows that improve detection of non-standard access and support governance activities
• Partner with senior engineers, architects, and security teams to ensure AI-enabled IAM solutions align with model governance, data protection, API security, access control, and compliance expectations
• Collaborate with the AI COE and AI Engineering team for best practices, technology, and AI support needs
• Support cloud non-human identity hygiene, including discovery, inventory review, ownership validation, credential and secret rotation support, stale or orphaned identity cleanup, privilege right-sizing, and key or policy review
• Strengthen authentication security by supporting modern authentication architecture, account fencing, reduction of legacy or non-standard authentication paths, and detection of risky sign-in behavior
• Configure and maintain authentication and authorization controls to ensure secure access to internal, external, cloud, and hybrid systems
• Automate IAM processes and workflows using scripting, integrations, and approved tooling to improve consistency, reduce manual work, and strengthen control execution
• Define, implement, and support Conditional Access and adaptive access policies, including Microsoft Entra ID controls, to advance Zero Trust principles
• Support the modernization and migration of IAM capabilities across cloud environments, including access policy design, entitlement governance, identity federation, and integration between on-premises and cloud systems
• Assess authentication and authorization baselines, identify non-standard or risky access patterns, and support risk-based remediation plans
• Support Cloud Infrastructure Entitlement Management and related cloud access governance activities, including visibility into permissions, excessive access, and entitlement risk
• Collaborate with internal teams, application owners, governance, audit, compliance, and business stakeholders to define access requirements, user roles, permissions, and remediation actions
• Develop and maintain documentation, procedures, dashboards, KPIs, KRIs, and reporting to support IAM operations, access governance, remediation tracking, and control effectiveness
• Stay current with IAM, cloud security, authentication, automation, AI security, and regulatory trends to continuously improve IAM practices and reduce risk

Requirements:

• Bachelor's degree in computer science, information technology, cybersecurity, data science, or a related field, or equivalent practical experience
• 8-10 years years in IAM engineering, cloud security, or GenAI/ML engineering
• Experience supporting IAM capabilities in cloud or hybrid environments, including Microsoft Entra ID, Okta, Azure, AWS, GCP, or similar platforms
• Experience implementing, supporting, or automating identity lifecycle management, access controls, authentication policies, and entitlement governance
• Strong knowledge of IAM concepts, including SSO, MFA, RBAC, PAM, identity federation, access governance, provisioning, deprovisioning, and periodic access reviews
• Knowledge of authentication and authorization protocols such as SAML, OAuth, OIDC, LDAP, and JWT
• Experience with Microsoft Entra ID, Okta, Azure AD, or similar IAM platforms
• Familiarity with cloud security concepts and tooling, including IAM policies, KMS, SIEM, Defender for Cloud, cloud logging, policy enforcement, and compliance monitoring
• Experience with scripting or automation using PowerShell, Python, Bash, SQL, or similar tools
• Understanding of non-human identities, service accounts, secrets, keys, privileged access, and cloud entitlement risk
• Familiarity with AI-enabled automation, retrieval-augmented generation, prompt design considerations, AI model security risks, or secure use of GenAI in enterprise environments
• Ability to assess IAM risks, analyze complex access patterns, and translate findings into clear remediation actions
• Strong analytical, troubleshooting, and problem-solving skills with attention to detail
• Effective communication skills, with the ability to partner across technical teams, business stakeholders, governance, compliance, and audit
• Knowledge of regulatory and compliance frameworks such as HIPAA, SOX, GDPR, and related security standards
• CISSP, CIPP, or IAM-specific certs. Cloud Security: AWS Security Specialty, Azure Security Engineer Associate (AZ-500), CKS. GenAI/ML: MLOps tools (MLflow), LLM frameworks (LangChain, Llama), RAG, GPTs
• Experience applying automation, scripting, or AI-enabled tools to improve IAM operations, access governance, or security workflows