Identity & Access Management Engineer

About the Role

The Identity and Access Management Engineer (Junior) supports the secure and reliable operation of identity services across the organisation. Working under the guidance of senior team members, the role assists with user lifecycle management, access provisioning, authentication, single sign-on, privileged access, and identity governance activities.

Key Responsibilities

• Strategic Focus
• Support the secure and reliable operation of identity and access management services across the organisation.
• Contribute to IAM, PAM, and identity governance initiatives through project delivery and operational support activities.
• Assist in implementing identity standards, controls, and automation aligned with the organisation’s security strategy.
• Support continuous improvement of identity lifecycle, authentication, and privileged access capabilities.
• Operational Management
• Manage approved joiner, mover, and leaver activities, including user provisioning, de-provisioning, access changes, and routine IAM troubleshooting.
• Provision, modify, and remove user, service, and privileged accounts across supported on-premises and cloud platforms.
• Apply approved access models, including role-based and attribute-based access controls, group membership, and entitlements.
• Support periodic access reviews and follow up outstanding certifications, exceptions, and remediation actions.
• Assist with the administration, configuration, testing, and support of hybrid Active Directory and Microsoft Entra ID environments.
• Support application onboarding for single sign-on, multifactor authentication, and automated provisioning using SAML 2.0, OAuth 2.0, OpenID Connect, and SCIM.
• Contribute to PowerShell, Microsoft Graph, and other scripts or workflows that automate repeatable IAM activities, with peer review before production use.
• Assist with identity services hosted across Azure and AWS and their supporting Windows, Linux, and virtualised infrastructure.
• Maintain daily IAM platform stability and compliance through service monitoring, BAU engineering, incident troubleshooting, fulfilment of service requests, and controlled changes.
• Troubleshoot access, authentication, federation, directory, and provisioning issues using documented procedures, system logs, and structured diagnostic techniques.
• Support Active Directory Domain Services and related technologies such as LDAP, Group Policy, DNS, certificate services, forest trusts, and remote access services under appropriate guidance.
• Maintain accurate tickets, work notes, configuration records, operational procedures, and handover information.
• People Leadership
• Build effective working relationships with application owners, Service Desk, infrastructure, cloud, security, and project teams.
• Collaborate with senior engineers and Identity Architects to deliver IAM and PAM enhancements.
• Demonstrate accountability, teamwork, and a commitment to continuous learning.
• Share knowledge and contribute to team capability through structured learning and practical assignments.
• Governance & Risk
• Support the discovery and onboarding of privileged accounts across servers, databases, cloud platforms, and enterprise applications.
• Assist with the implementation and uplift of privileged-access controls, including conditional access, multifactor authentication, least privilege, account discovery, and automated password rotation.
• Follow least-privilege, segregation-of-duties, privacy, and privileged-access requirements when administering identity services.
• Support audit and assurance activities by maintaining complete access records, approvals, evidence, and operational documentation.
• Identify control gaps, recurring incidents, and opportunities for automation or service improvement and escalate recommendations through the appropriate process.
• Escalate risks, exceptions, and complex technical matters through appropriate governance processes.

Requirements & Tech Stack

• Identity & Access Management
• IAM
• PAM
• IGA
• Identity Lifecycle Management
• Authentication
• Authorization
• Least Privilege
• Conditional Access
• Multifactor Authentication
• RBAC (Role-Based Access Control)
• ABAC (Attribute-Based Access Control)
• Directory Services & Authentication Protocols
• Active Directory
• Microsoft Entra ID
• Hybrid Environments
• Microsoft Identity Manager (advantageous)
• Entra ID Connect (advantageous)
• SAML 2.0
• OAuth 2.0
• OpenID Connect
• SCIM
• LDAP
• Federation
• API Concepts
• Active Directory Domain Services
• Group Policy
• DNS
• Certificate Services
• Forest Trusts
• Remote Access Services
• Cloud & Virtualisation
• Azure
• AWS
• Virtualisation
• Linux (desirable)
• Scripting & Automation
• PowerShell (Basic to Intermediate)
• Microsoft Graph (desirable)
• Other Technologies
• Windows Server
• CyberArk (advantageous)
• SailPoint (advantageous)

Qualifications

• Degree, diploma, or equivalent practical training in Information Technology, Computer Science, Cybersecurity, or a related discipline.
• 4+ years of relevant experience in IAM, directory services, systems administration, IT support, or cybersecurity. Graduates with relevant practical exposure are encouraged to apply.
• Foundational understanding of identity lifecycle management, authentication, authorization, least privilege, conditional access, multifactor authentication, RBAC, and ABAC.
• Practical exposure to Active Directory and Microsoft Entra ID in a hybrid environment.
• Working knowledge of SAML 2.0, OAuth 2.0, OpenID Connect, SCIM, LDAP, federation, and API concepts.
• Basic to intermediate PowerShell and scripting capability.
• Awareness of Windows Server and Active Directory services, including Group Policy, DNS, certificate services, and forest trusts.
• Foundational cloud knowledge across Azure or AWS.
• Basic familiarity with virtualisation.
• Relevant Microsoft, cloud, IAM, or security certifications are desirable but not essential.

Personal Attributes

• Strong problem-solving and troubleshooting skills.
• Ability to work independently on assigned tasks and seek guidance for complex or high-risk matters.
• Balanced interest in operational support, incident resolution, debugging, and engineering delivery.
• Strong attention to detail and a disciplined approach to approvals, testing, evidence, and record keeping.
• Clear written and verbal communication skills.
• Ability to build constructive relationships with technical teams and business partners.
• Able to prioritise assigned work, meet agreed deadlines, raise blockers early, and contribute effectively in a complex enterprise environment.
• Demonstrates integrity, accountability, teamwork, and a commitment to continuous learning.