Note: The job is a remote job and is open to candidates in USA. Relativity is seeking an Advanced IAM Engineer to serve as a hands-on operational backbone for its enterprise identity and access management function. The role designs, deploys, and optimizes identity technologies across workforce, customer, machine, and AI-agent domains while improving identity threat detection and response.
Responsibilities
- Implement and operate identity controls spanning workforce, machine, and workload identity as part of a layered defense-in-depth model
- Operate continuous adaptive trust mechanisms, including continuous access evaluation (CAE), risk-based step-up authentication, and session revocation, that re-verify identity against real-time posture and behavioral signals rather than at the access gate alone
- Configure ZTNA, least-privilege access, phishing-resistant MFA/FIDO2, and JIT access across access paths
- Implement SSO, federation, and authentication standards (SAML, OAuth 2.0, OIDC, SCIM, Kerberos, LDAP) across SaaS and multi-cloud environments
- Apply hardening standards to identity infrastructure using CIS Benchmarks/DISA STIGs with automated compliance validation
- Build and maintain identity lifecycle automation (joiner/mover/leaver) integrating HR systems, directories, and downstream applications
- Operate identity governance and administration (IGA) workflows: access reviews, certification campaigns, and segregation-of-duties checks
- Administer privileged access management (PAM) including credential vaulting, JIT elevation, and session monitoring
- Maintain governance of non-human identities (service accounts, workloads, secrets) using drift detection and policy-as-code
- Feed identity telemetry into the detection stack (SIEM/SOAR, UEBA) to support detection of credential abuse, privilege escalation, and lateral movement
- Execute identity-focused IR playbook steps for account takeover, credential compromise, and session hijacking
- Implement identity checks in CI/CD pipelines (secret scanning, IaC identity analysis), acting on AI-generated fix recommendations in PR workflows
- Track identity hygiene metrics and support audits, certifications, and e-discovery requirements alongside GRC
Skills
- Must be able to obtain and maintain the required Public Trust clearance for this role
- Bachelor's in Computer Science, Information Security, or equivalent experience
- 5+ years of hands-on experience in enterprise IAM or security engineering, with a focus on identity, authentication, and access domains, or a Master's degree in Cybersecurity or a relevant field
- Hands-on experience with common identity tools such as IdP/SSO (Okta, Entra ID/Azure AD, Ping), IGA (SailPoint, Saviynt), PAM (CyberArk, BeyondTrust), and directory services, plus intermediate knowledge of authentication and federation protocols (SAML, OIDC, OAuth 2.0, SCIM, LDAP, Kerberos)
- Basic knowledge of industry-standard security benchmarks and frameworks (MITRE, NIST 800-63, Zero Trust)
- Proficiency in at least one scripting/automation language (Python, Bash, or PowerShell) applied to modern containerized services, CLI-based commands, and/or identity-specific use cases (API-driven provisioning, policy-as-code)
- Ability to communicate technical findings clearly to both engineering peers and non-technical stakeholders
- Familiarity with AI-enabled identity operations (UEBA, ML-based access-risk scoring, or AI-assisted access-review and threat-hunting workflows)
- Basic knowledge of common cloud environments (AWS, Azure, or GCP) and their native identity services (IAM, RBAC, workload identity)
- Working knowledge of the software development lifecycle, software engineering practices, or infrastructure-as-code environments: contributing identity and access controls (secrets management, workload identity, policy-as-code) to CI/CD pipelines
- Experience with non-human, workload, and AI-agent identity, secrets management, and machine-to-machine authentication
- Experience supporting compliance and audit requirements (SOC 2, ISO 27001, FedRAMP, HIPAA) from an identity and access control perspective
- Relevant certifications such as SC-300 (Microsoft Identity and Access Administrator), AZ-500 (Azure Security Engineer), Okta Certified Professional/Administrator, SailPoint IdentityIQ, SEC+, CISSP, CISA, or equivalent
Benefits
- An annual performance bonus
- Long-term incentives
- Remote work
Company Overview
Company H1B Sponsorship