Principal IAM Engineer

The role

This is a senior individual-contributor role acting as the technical authority for identity. You will own the identity control plane end to end, including identity lifecycle, access management, and identity automation.

What you will do

• Own the identity lifecycle including automated provisioning and deprovisioning
• Own access management including Conditional Access, phishing-resistant MFA, and privileged access
• Own directory and federation across Entra ID, single sign-on, SAML, OIDC, and OAuth2
• Own secrets and non-human identity including API keys, service accounts, and workload identity
• Own key access governance and separation of duties
• Own identity automation and identity-as-code using Terraform and policy-as-code
• Own the identity-verification standard for the service desk

Required qualifications

• Minimum of 8 years in identity and access management, including principal- or staff-level ownership of an identity control plane
• Deep Microsoft Entra ID engineering, including Conditional Access policy design, phishing-resistant MFA, single sign-on, and federation across SAML, OIDC, and OAuth2
• Identity lifecycle automation across cloud, SaaS, and privileged systems using RBAC/ABAC
• Zero Trust identity design, including least-privilege, just-in-time (JIT) access, and risk-based or adaptive access controls
• Identity governance and administration (IGA) platform engineering, including privileged access management
• Automation and scripting (PowerShell, Python, or similar)
• Identity-as-code and policy-as-code practice using Terraform with source-controlled change management
• Secrets and non-human identity management and maintaining an owner registry
• Key access governance and separation of duties
• Ability to act as technical authority without formal people-management authority
• Bachelor’s degree in a relevant field, or equivalent professional experience

Nice to have

• Healthcare or another regulated environment where identity controls gate access to PHI
• Hands-on Saviynt with PAM, Azure PIM, and Keeper, or transferable depth in comparable platforms
• Experience remediating a Conditional Access enforcement gap or a deprovisioning failure
• Passkeys and FIDO2, or phishing-resistant authenticator experience, aligned with NIST SP 800-63 Rev. 4
• Experience growing a technical scope into a broader leadership remit
• Microsoft Identity and Access Administrator certification, CIMP, or equivalent

Benefits

• Medical Insurance
• Dental Insurance
• Vision Insurance
• Short & Long Term Disability
• Life Insurance
• 401k with company match
• Flexible Time Off
• Paid Parental Leave

About the company

Lantern is a specialty care platform connecting people with a Network of Excellence of specialists for surgery, cancer care, infusions and more. It operates in a regulated healthcare environment and is becoming an AI healthcare company.