Job Summary
IAM Operations L2 Engineer is responsible for the administration, support, and maintenance of Identity and Access Management (IAM) services. The role focuses on user lifecycle management, access provisioning/de-provisioning, privileged access controls, authentication services, incident resolution, and compliance adherence. The engineer acts as an escalation point for L1 teams and ensures IAM services meet security, operational, and audit requirements.
Key Responsibilities
Access Management Provision, modify, and revoke user access across enterprise applications and infrastructure. Perform role-based access control (RBAC) administration. Execute Joiner-Mover-Leaver (JML) activities. Review and validate access requests against approval matrices and policies. Identity Management Manage user identities in Active Directory, Azure AD/Entra ID, LDAP, and other identity repositories. Support identity synchronization and federation services. Maintain user and group lifecycle processes. Authentication & SSO Support Support Single Sign-On (SSO) platforms such as Okta, Azure AD, Ping Identity, or ADFS. Troubleshoot MFA issues and authentication failures. Manage federation protocols such as SAML, OAuth, OpenID Connect, and LDAP. Privileged Access Management (PAM) Support PAM solutions such as CyberArk, BeyondTrust, Delinea, or HashiCorp Vault. Manage privileged account onboarding, password rotations, and access approvals. Monitor privileged account activities and investigate anomalies. Incident & Problem Management Resolve L2 IAM incidents within agreed SLAs. Perform root cause analysis for recurring access or authentication issues. Coordinate with application, infrastructure, and security teams during major incidents. Compliance & Audit Support periodic access certification and entitlement reviews. Ensure compliance with SOX, ISO 27001, GDPR, HIPAA, or other regulatory requirements. Maintain audit-ready documentation and operational records. Automation & Continuous Improvement Identify opportunities for IAM process automation. Develop scripts using PowerShell, Python, or automation tools. Contribute to operational excellence and service improvement initiatives.
Skill Requirements
Required Technical Skills Mandatory Active Directory (AD) Administration Azure AD / Microsoft Entra ID IAM Concepts (RBAC, ABAC, Least Privilege) MFA and SSO Administration LDAP and Directory Services ITIL Incident, Change, and Problem Management Access Governance and Compliance Preferred CyberArk / BeyondTrust / Delinea PAM SailPoint IdentityIQ / IdentityNow Saviynt Okta Ping Identity ServiceNow PowerShell / Python Scripting Azure Cloud Identity Services Soft Skills Strong troubleshooting and analytical skills. Effective stakeholder communication. Ability to handle escalations and priority incidents. Documentation and process-oriented mindset. Team collaboration and customer focus.
Other Requirements
Key Performance Indicators (KPIs) SLA compliance for IAM tickets. Access provisioning/de-provisioning turnaround time. IAM incident resolution time. Audit findings and compliance adherence. Automation and process improvement contributions. Customer satisfaction score (CSAT).