IAM Secure Access Engineer

Today’s world is fueled by vast amounts of information. Data is more valuable than ever before. Protecting data and information systems is central to doing business, and everyone in EY Information Security has a critical role to play. Join a integral team of professionals who collaborate to support the business by protecting information assets. Our Information Security professionals enable the organization to work securely and deliver secure products and services, as well as detect and respond to security events as they happen.

Within Information Security, we blend risk strategy, digital identity, cyber defense, application security and technology solutions across the security lifecycle. You will join a team of security-focused professionals dedicated to supporting, protecting and enabling the business through innovative and secure solutions that provide business value.

The opportunity

As part of the Identity and Access Management organization, the IAM Secure Access Engineer will design, configure, test and implement authentication, federation and authorization capabilities across enterprise, cloud and hybrid environments.

The role combines traditional IAM engineering fundamentals with delivery of new Secure Access initiatives across Microsoft Entra ID, Conditional Access, PingID, PingFederate, PingAccess, Okta, PlainID, multifactor authentication, passwordless authentication, workload identities, token protection and secrets or certificate-based authentication.

The engineer will work with Architecture, Product, Operations, application teams and vendors to translate requirements into secure, supportable solutions and move changes through design, build, test,



production deployment and operational handover.

Your key responsibilities

Authentication, Federation & Access Engineering

- Design, configure and support authentication and federation integrations using SAML 2.0, OAuth 2.0, OpenID Connect and related standards.
- Implement and maintain MFA, single sign-on, passwordless authentication and risk-based access controls.
- Configure and troubleshoot PingID, PingFederate, PingAccess, Okta and Microsoft Entra ID integrations.
- Support onboarding and migration of applications to modern authentication patterns.
- Analyze authentication failures, policy conflicts, token issues and user access problems across integrated platforms.

Conditional Access & Identity Protection

- Implement and enhance Microsoft Entra Conditional Access policies, authentication strengths, authentication contexts and protected actions.
- Support Continuous Access Evaluation, token protection, sign-in risk controls and secure administrative access patterns.
- Assess policy impact, exclusions, break-glass requirements and deployment risks before production release.
- Use logs and platform telemetry to validate control effectiveness and investigate access issues.

Authorization, Workload Identity & Secrets

- Implement policy-based authorization using PlainID or comparable authorization platforms.
- Support role-based,



attribute-based and policy-based access control patterns.
- Improve security for service principals, managed identities, application identities and other non-human identities.
- Support migration from shared secrets to managed identity, certificates or approved vault-based patterns.
- Coordinate certificate, key and secret lifecycle activities with PKI, vault and application teams.

Engineering Delivery & Operations

- Create technical designs, implementation plans, test cases, rollback plans and operational documentation.
- Raise and manage Change Requests and support production deployments through established controls.
- Automate repeatable administration and validation tasks using PowerShell, REST APIs or other approved scripting methods.
- Perform unit, integration, regression and security testing and support post-deployment validation.
- Participate in incident, problem, vulnerability remediation and continual improvement activities.

Skills and attributes for success

- Solid understanding of authentication, authorization, identity federation, MFA, SSO and Zero Trust principles.
- Hands-on experience with at least two of the following: Microsoft Entra ID, PingID, PingFederate, PingAccess, Okta or PlainID.
- Working knowledge of SAML, OAuth 2.0, OpenID Connect, JWT, SCIM, LDAP, Kerberos and RADIUS.
- Experience with Conditional Access, Identity Protection, workload identities or modern authentication controls.
- PowerShell or comparable scripting experience and the ability to work with REST APIs, JSON and certificates.
- Strong troubleshooting, documentation, testing and stakeholder communication skills.
- Understanding of

📌 Security Engineer (Tandil)
🏢 EY
📍 Tandil