Note: The job is a remote job and is open to candidates in USA. HealthEquity is a company dedicated to saving and improving lives by empowering healthcare consumers. They are seeking a Senior IAM Cloud Engineer to design, secure, and operate AI-driven systems in cloud environments, focusing on identity and access management and cloud security.
Responsibilities
- Design, implement, and maintain IAM frameworks (SSO, MFA, RBAC, PAM) across multi-cloud environments (AWS, Azure, GCP). Harden cloud environments using IAM policies, KMS, WAF, GuardDuty, Defender for Cloud, and compliance tools. Automate identity lifecycle management, provisioning, and deprovisioning
- Define and standardize IAM cloud access structures and secure cloud configurations. Build detection pipelines, automate compliance checks, and integrate CEIM tools
- Support the secure use of Generative AI capabilities within IAM environments, including use cases related to access analysis, anomaly detection, issue summarization, remediation recommendations, and operational workflow automation
- Contribute to the design, testing, and refinement of AI-enabled IAM tools, prompts, retrieval strategies, and automation workflows that improve detection of non-standard access and support governance activities
- Partner with senior engineers, architects, and security teams to ensure AI-enabled IAM solutions align with model governance, data protection, API security, access control, and compliance expectations
- Collaborate with the AI COE and AI Engineering team for best practices, technology, and AI support needs
- Support cloud non-human identity hygiene, including discovery, inventory review, ownership validation, credential and secret rotation support, stale or orphaned identity cleanup, privilege right-sizing, and key or policy review
- Strengthen authentication security by supporting modern authentication architecture, account fencing, reduction of legacy or non-standard authentication paths, and detection of risky sign-in behavior
- Configure and maintain authentication and authorization controls to ensure secure access to internal, external, cloud, and hybrid systems
- Automate IAM processes and workflows using scripting, integrations, and approved tooling to improve consistency, reduce manual work, and strengthen control execution
- Define, implement, and support Conditional Access and adaptive access policies, including Microsoft Entra ID controls, to advance Zero Trust principles
- Support the modernization and migration of IAM capabilities across cloud environments, including access policy design, entitlement governance, identity federation, and integration between on-premises and cloud systems
- Assess authentication and authorization baselines, identify non-standard or risky access patterns, and support risk-based remediation plans
- Support Cloud Infrastructure Entitlement Management and related cloud access governance activities, including visibility into permissions, excessive access, and entitlement risk
- Collaborate with internal teams, application owners, governance, audit, compliance, and business stakeholders to define access requirements, user roles, permissions, and remediation actions
- Develop and maintain documentation, procedures, dashboards, KPIs, KRIs, and reporting to support IAM operations, access governance, remediation tracking, and control effectiveness
- Stay current with IAM, cloud security, authentication, automation, AI security, and regulatory trends to continuously improve IAM practices and reduce risk
Skills
- Bachelor's degree in computer science, information technology, cybersecurity, data science, or a related field, or equivalent practical experience
- 8-10 years years in IAM engineering, cloud security, or GenAI/ML engineering
- Experience supporting IAM capabilities in cloud or hybrid environments, including Microsoft Entra ID, Okta, Azure, AWS, GCP, or similar platforms
- Experience implementing, supporting, or automating identity lifecycle management, access controls, authentication policies, and entitlement governance
- Strong knowledge of IAM concepts, including SSO, MFA, RBAC, PAM, identity federation, access governance, provisioning, deprovisioning, and periodic access reviews
- Knowledge of authentication and authorization protocols such as SAML, OAuth, OIDC, LDAP, and JWT
- Experience with Microsoft Entra ID, Okta, Azure AD, or similar IAM platforms
- Familiarity with cloud security concepts and tooling, including IAM policies, KMS, SIEM, Defender for Cloud, cloud logging, policy enforcement, and compliance monitoring
- Experience with scripting or automation using PowerShell, Python, Bash, SQL, or similar tools
- Understanding of non-human identities, service accounts, secrets, keys, privileged access, and cloud entitlement risk
- Familiarity with AI-enabled automation, retrieval-augmented generation, prompt design considerations, AI model security risks, or secure use of GenAI in enterprise environments
- Ability to assess IAM risks, analyze complex access patterns, and translate findings into clear remediation actions
- Strong analytical, troubleshooting, and problem-solving skills with attention to detail
- Effective communication skills, with the ability to partner across technical teams, business stakeholders, governance, compliance, and audit
- Knowledge of regulatory and compliance frameworks such as HIPAA, SOX, GDPR, and related security standards
- CISSP, CIPP, or IAM-specific certs. Cloud Security: AWS Security Specialty, Azure Security Engineer Associate (AZ-500), CKS. GenAI/ML: MLOps tools (MLflow), LLM frameworks (LangChain, Llama), RAG, GPTs
- Experience applying automation, scripting, or AI-enabled tools to improve IAM operations, access governance, or security workflows
Benefits
- Medical, dental, and vision
- HSA contribution and match
- Dependent care FSA match
- Uncapped paid time off
- Paid parental leave
- 401(k) match
- Personal and healthcare financial literacy programs
- Ongoing education & tuition assistance
- Gym and fitness reimbursement
- Wellness program incentives
- This is a remote position.
- Remote role, with an in-person onboarding training component
- Trailhead is held onsite at our headquarters once per quarter
- HealthEquity covers all required travel and accommodations
Company Overview
Company H1B Sponsorship