layiq

/la·yiq/adjective

worthy; deserving; fitting; suitable.

A role, opportunity, or path that merits attention, time, and pursuit.

LAYIQ - IT IAM Engineer at Panthalassa

Identity Infrastructure
Administer Microsoft Entra ID, including user lifecycle, group management, dynamic membership rules, and role assignment.
Design and maintain Conditional Access policy, tying device compliance posture, identity signals, risk, and location to resource access.
Own authentication standards: MFA, phishing-resistant methods, passwordless rollout, and legacy auth retirement.
Partner with our Endpoint Engineer so access policy and device posture stay in sync.
Access Automation and Lifecycle
Automate joiner, mover, and leaver so access is granted and revoked from a source of truth rather than a ticket.
Manage SSO integrations and application provisioning via SAML and SCIM across our SaaS stack.
Build and run access review and recertification cycles that produce evidence auditors accept.
Implement least privilege for privileged roles, including just-in-time elevation and break-glass procedures.
Non-Human Identity and Governance
Govern service accounts, OAuth grants, and API credentials: naming conventions, ownership, scope review, and rotation.
Establish where secrets live and how they are issued, stored, and retired.
Maintain a defensible inventory of who and what can reach our systems.
Security and Compliance
Advance our zero trust roadmap and translate policy into enforceable technical controls.
Own the access control domain of our compliance framework (NIST or equivalent), including documentation and evidence.
Partner with information security leadership on access control policy, identity threat detection, and incident response involving compromised accounts.
Required Qualifications
Experience administering identity and access in a modern IdP, including user lifecycle, groups, and conditional or context-aware access.
Experience implementing SSO and provisioning integrations (SAML, SCIM) across a SaaS stack.
Automation experience: scripting or API work against identity and SaaS platforms rather than console-only administration.
Ability to write clear documentation and turn written policy into enforceable technical controls.
Ability to explain the reasoning behind an access decision to a non-technical audience and get buy-in.
Desired Qualifications
Experience owning an IdP at a growing technology company.
Familiarity with zero trust architecture and how it translates into identity controls.
Experience with identity governance and administration: access reviews, entitlement management, and privileged access.
Experience governing non-human identities, service accounts, and OAuth scopes.
Experience supporting or implementing a security or compliance framework (NIST, ISO 27001, SOC 2, or equivalent).
Experience with identity threat detection and response, or investigating account compromise.
The above qualifications are desired, not required. We encourage you to apply if you are a strong candidate with only some of the desired skills and experience listed.
Additional Requirements
Available for occasional off-hours work to support identity migrations, tenant changes, and access cutovers that have to land outside business hours.
Participate in incident response when accounts or credentials are involved, including outside business hours.
Travel to the Portland office quarterly if working remotely.
Intermittently able to work longer hours to support critical needs. While we expect a lot of each other, we also offer a high degree of autonomy and work-life balance, including flexible PTO and flexible working hours.

IT IAM Engineer

Employer job description

About the Company

About the Job

Responsibilities

Compensation and Benefits

About this listing

Listing check

Similar jobs

Similar jobs