Identity and Access Management Engineer 3 - Identity & Access Management

Job Description:

Our Opportunity

Chewy's IAM team keeps the right people, services, and AI agents connected to the right access, from someone's first day to their last. As an IAM Engineer III, a senior individual-contributor role, you'll set technical direction for our identity platforms, primarily SailPoint Identity Security Cloud alongside Okta, and own the big projects that make whole categories of manual work disappear.

This isn't a ticket-queue role. Your success is measured by the work you eliminate: request types automated away, manual steps removed, and cycle times cut, all while keeping strong controls and clean audit evidence. You'll mentor IAM Engineer I and II staff, lead design reviews, and help shape how Chewy governs non-human identities, including AI agents.

What You'll Own in Your First Year

• Modernize the joiner experience. Redesign how new hires move from offer to day one: accounts ready ahead of time, the right access exactly on the start date, and nothing early.
• Automate birthright access at scale. Turn manual license and access requests into rule-based roles that grant and remove access on their own as people join, move, and leave.
• Strengthen the leaver and contractor lifecycle. Make sure access ends exactly when employment or a contract ends, with proof.
• Onboard and run SailPoint Machine Identity Security (MIS) and Data Access Security (DAS), extending governance to service accounts, machine identities, and sensitive data access.
• Consolidate access onto modern, requestable patterns, working with our identity provider experts to move app access off legacy directory groups.
• Build safe automation, with AI where it helps, that removes manual work, keeps human approval where it matters, and leaves clear evidence for audit.

What You'll Do

• Own IAM projects end to end: define the problem and the starting numbers, design the fix, lead the build, roll it out, and prove the result.
• Hunt down repeat work. Turn recurring tickets, incidents, and review findings into automation or self-service that removes them for good.
• Set direction and design solutions in SailPoint ISC: lifecycle, provisioning, correlation, connectors, transforms, workflows, and roles, with safe change practices (testing, staged rollout, rollback).
• Partner with our Okta experts on application access, lifecycle, and provisioning patterns.
• Own the technical debt list for your area and clear the highest-value items first.
• Lead root-cause analysis for serious failures and turn each into a lasting fix.
• Mentor IAM Engineer I and II staff through design reviews and pairing.
• Govern non-human identities (service accounts, workloads, AI agents) and take part in the on-call rotation for critical identity services.

Bonus (Nice to Have)

• SailPoint ISC certification (e.g. ISC Engineer) and/or Okta Certified Professional or Administrator
• Experience building AI-assisted automation or agent-based workflows, with human approval steps and audit-ready evidence
• Experience governing non-human identities: service accounts, workload identities, or AI agent credentials
• Experience with HR-driven lifecycle (Workday as the source of truth) and birthright role design at scale
• Experience integrating identity with service management (ServiceNow catalog and request flows)
• Background in audit and control evidence: certifications, separation of duties, least privilege

The base salary range for this role is $118,500 - $189,500.00.

• The specific salary offered to a candidate may be influenced by a variety of factors including but not limited to the candidate’s relevant experience, education, and work location. In addition, this position is eligible for 401k and a new hire and annual equity grant. C08+ positions may also be eligible for annual bonus.

We offer different types of insurance and benefits, such as medical/Rx, vision, dental, life, disability, hospital indemnity, critical illness, and accident. We offer parental leave, family services benefits, backup dependent care, flexible spending accounts, telemedicine, pet adoption reimbursement, employee assistance program, and many discounts including 10% off pet insurance and 20% off at Chewy.com. 

Exempt salary team members have unlimited PTO, subject to manager approval. Team members will receive six paid holidays per year. Team members may be eligible for paid sick and family leave in compliance with applicable state and local regulations. 

Chewy is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, ancestry, national origin, gender, citizenship, marital status, religion, age, disability, gender identity, results of genetic testing, veteran status, as well as any other legally-protected characteristic. If you have a disability under the Americans with Disabilities Act or similar law, and you need an accommodation during the application process or to perform these job requirements, or if you need a religious accommodation, please contact [email protected].

To access Chewy's California CPRA Job Applicant Privacy Policy, please click here.