Senior IAM Engineer - Identity Governance

About Aubrant 

Aubrant Digital is a leader in multi-shore custom application development. We are passionate about solving our clients’ business problems through consultative teamwork, innovative software, and proven processes. We’ve served more than 50 clients and delivered hundreds of high quality, custom enterprise applications.  Our clients value us as integral team members who get the job done on time and on spec, and we are proud of our high client retention rate and under 2% staff turnover. With offices in New Jersey, Boston, Costa Rica, and Eastern Europe, we execute the full software lifecycle, from architecture and design through development, QA and application maintenance & support.  Our company culture emphasizes client service, trust-based relationships, and innovation. 

About the role

• Aubrant Digital is seeking a Senior IAM Engineer, Identity Governance, to be the go-to engineer for a large US-based client's SailPoint environment, which governs 75,000+ identities. You will own SailPoint configuration, updates, upgrades, and incident response; plan and run access certification campaigns; build and maintain connectors and workflows; own joiner, mover, and leaver processes and script provisioning that is still manual; run updates that can't happen during the day in planned off-hours windows; and support CyberArk privileged access operations. You will back up the senior Ping engineer, who backs you up in turn. You will join Aubrant's cloud and infrastructure engineering group (we call it a Studio), which gives you a technical leader to escalate to, peers on other engagements to call on, and a shared catalog of scripts and hardened builds to start from. 

Must-Have Requirements

• 7+ years in identity and access management, with 4+ years hands-on with SailPoint 

• Access certification campaigns.

• Building and maintaining SailPoint connectors and workflows.

• Joiner, mover, and leaver process design and automation.

• Active Directory and Entra ID in a hybrid setup.

• Scripting in PowerShell or Python, with changes kept in a Git repository (the client uses GitHub).

• Ability to triage and resolve tickets and alerts independently through incident, change, and problem management, escalating only when needed.

• Willingness and availability to participate in the client's seven-day on-call rotation and to shift working hours for planned overnight maintenance windows.

• Professional written and spoken English; daily collaboration with a US-based client team.

Should-Have Requirements

• Ping (PingFederate) and SSO, enough to cover for the Ping engineer.

• CyberArk.

• Microsoft 365 administration.

• GitHub and ServiceNow.

• Automating identity processes beyond scripting: forms, workflows, and built-in tool features that remove manual steps such as service account requests.

Could-Have / Nice-to-Have Requirements

• Relevant vendor certifications (not required; hands-on experience is valued over certificates).

Ideal Candidate Traits:

• Curious, proactive, and collaborative.

• Strong communication and teamwork skills are important.

• Committed to delivering solutions together, not in competition. Embraces Works Agile comfortably methodology inside the client's incident, change, and problem management, keeps looking for the next thing to automate, and promotes a one-team culture.