Principal IAM Engineer

Employer Direct Healthcare

. Serve as Lantern’s technical authority for identity and own the identity control plane end to end.

Posted 10/30/2026full-timeDallas • Texas • United StatesLeadWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in identity and access management, including ownership of identity control planes, Zero Trust identity design, and identity lifecycle automation. Proficient in implementing Conditional Access, privileged access management, and identity governance in regulated environments.

Highest-signal resume keywords

Identity Control Plane OwnershipMicrosoft Entra ID EngineeringZero Trust Identity DesignIdentity Lifecycle AutomationIdentity Governance and Administration

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

RBACABACIdentity Lifecycle AutomationConditional Access Policy DesignIdentity-as-CodePolicy-as-CodeSecrets ManagementPrivileged Access ManagementAutomation and ScriptingKey Access Governance

Soft Skills

Technical AuthorityCollaboration

Tools & Technologies

TerraformPowerShellPythonSaviyntAzure PIMKeeperSAMLOIDCOAuth2FIDO2

Certifications & Qualifications

Microsoft Identity and Access Administrator CertificationCIMP

Industry Keywords

HealthcareRegulated EnvironmentPHIGovernanceRisk and Compliance

Tech Stack

Tools & technologies

AzureCloudPythonTerraform

About the role

Key responsibilities & impact

Serve as Lantern’s technical authority for identity and own the identity control plane end to end.
Own joiner, mover, and leaver provisioning and deprovisioning using RBAC/ABAC models, with deprovisioning verified against an entitlement inventory.
Own access management, including Conditional Access, phishing-resistant MFA, privileged access, least privilege, JIT elevation, and Zero Trust enforcement.
Own directory and federation across Entra ID, SSO, SAML, OIDC, and OAuth2.
Own secrets and non-human identity, including API keys, service accounts, workload identity, and an owner registry.
Govern key access and separation of duties while another team operates the key management system.
Build identity automation and identity-as-code using Terraform and policy-as-code.
Set identity-verification standards for password resets, MFA resets, and device enrollment.
Deliver enforced Conditional Access on PHI-facing applications, automated lifecycle provisioning/deprovisioning, a secrets golden path, phishing-resistant MFA for privileged accounts, and documented runbooks.
Partner with the IAM engineer, platform, cloud, service delivery, HR, and Governance, Risk & Compliance teams; report to the CISO.

Requirements

What you’ll need

Eight or more years in identity and access management, including principal- or staff-level ownership of an identity control plane.
Deep Microsoft Entra ID engineering, including Conditional Access policy design, phishing-resistant MFA, single sign-on, and federation across SAML, OIDC, and OAuth2, and verifying that enforcement takes effect across every access path, not only the expected one.
Identity lifecycle automation across cloud, SaaS, and privileged systems, with role- and attribute-based provisioning (RBAC/ABAC) and deprovisioning verified against an entitlement inventory.
Zero Trust identity design, including least-privilege, just-in-time (JIT) access, and risk-based or adaptive access controls.
Identity governance and administration (IGA) platform engineering, including privileged access management.
Automation and scripting (PowerShell, Python, or similar) to build lifecycle workflows and custom connectors.
Identity-as-code and policy-as-code practice, using Terraform with source-controlled change management (for example, GitHub).
Secrets and non-human identity (API keys, service accounts, workload identity), and maintaining an owner registry for them.
Key access governance and separation of duties in a model where another team operates the key management system.
Ability to act as the technical authority for a function without formal people-management authority, working directly to a CISO.
Bachelor’s degree in a relevant field, or equivalent professional experience.
Healthcare or another regulated environment where identity controls gate access to PHI.
Hands-on Saviynt with PAM, Azure PIM, and Keeper, or transferable depth in comparable platforms.
Experience remediating a Conditional Access enforcement gap or a deprovisioning failure, and making the structural change that prevented recurrence.
Passkeys and FIDO2, or phishing-resistant authenticator experience, aligned with NIST SP 800-63 Rev. 4.
Experience growing a technical scope into a broader leadership remit.
Microsoft Identity and Access Administrator certification, CIMP, or equivalent.

Benefits

Comp & perks

Medical Insurance
Dental Insurance
Vision Insurance
Short & Long Term Disability
Life Insurance
401k with company match
Flexible Time Off
Paid Parental Leave