Advanced Security Engineer (IAM)
About this role
Posting Type
Remote
Job Overview
The Advanced IAM Engineer is a technically deep, hands-on practitioner who forms the operational backbone of the enterprise IAM function. Treating identity as the primary control plane in a defense-in-depth program, this engineer designs, deploys, and optimizes AI-enabled identity technologies across the workforce, customer, and non-human (machine and agent) identity domains. Partnering with the Manager of Enterprise Security and cross-functional teams, the role reduces Relativity's identity attack surface and improves detection and response times for identity-based threats.Job Description and Requirements
Role Responsibilities
Continuous Adaptive Trust & Identity Operations
Implement and operate identity controls spanning workforce, machine, and workload identity as part of a layered defense-in-depth model.
Operate continuous adaptive trust mechanisms, including continuous access evaluation (CAE), risk-based step-up authentication, and session revocation, that re-verify identity against real-time posture and behavioral signals rather than at the access gate alone.
Configure ZTNA, least-privilege access, phishing-resistant MFA/FIDO2, and JIT access across access paths.
Implement SSO, federation, and authentication standards (SAML, OAuth 2.0, OIDC, SCIM, Kerberos, LDAP) across SaaS and multi-cloud environments.
Apply hardening standards to identity infrastructure using CIS Benchmarks/DISA STIGs with automated compliance validation.
Identity Lifecycle, Governance & PAM
Build and maintain identity lifecycle automation (joiner/mover/leaver) integrating HR systems, directories, and downstream applications.
Operate identity governance and administration (IGA) workflows: access reviews, certification campaigns, and segregation-of-duties checks.
Administer privileged access management (PAM) including credential vaulting, JIT elevation, and session monitoring.
Maintain governance of non-human identities (service accounts, workloads, secrets) using drift detection and policy-as-code.
Detection, Response & Collaboration
Feed identity telemetry into the detection stack (SIEM/SOAR, UEBA) to support detection of credential abuse, privilege escalation, and lateral movement.
Execute identity-focused IR playbook steps for account takeover, credential compromise, and session hijacking.
Implement identity checks in CI/CD pipelines (secret scanning, IaC identity analysis), acting on AI-generated fix recommendations in PR workflows.
Track identity hygiene metrics and support audits, certifications, and e-discovery requirements alongside GRC.
Minimum qualifications:
Bachelor's in Computer Science, Information Security, or equivalent experience.
5+ years of hands-on experience in enterprise IAM or security engineering, with a focus on identity, authentication, and access domains, or a Master's degree in Cybersecurity or a relevant field.
Hands-on experience with common identity tools such as IdP/SSO (Okta, Entra ID/Azure AD, Ping), IGA (SailPoint, Saviynt), PAM (CyberArk, BeyondTrust), and directory services, plus intermediate knowledge of authentication and federation protocols (SAML, OIDC, OAuth 2.0, SCIM, LDAP, Kerberos).
Basic knowledge of industry-standard security benchmarks and frameworks (MITRE, NIST 800-63, Zero Trust).
Proficiency in at least one scripting/automation language (Python, Bash, or PowerShell) applied to modern containerized services, CLI-based commands, and/or identity-specific use cases (API-driven provisioning, policy-as-code).
Ability to communicate technical findings clearly to both engineering peers and non-technical stakeholders.
Preferred qualifications:
Familiarity with AI-enabled identity operations (UEBA, ML-based access-risk scoring, or AI-assisted access-review and threat-hunting workflows).
Basic knowledge of common cloud environments (AWS, Azure, or GCP) and their native identity services (IAM, RBAC, workload identity).
Working knowledge of the software development lifecycle, software engineering practices, or infrastructure-as-code environments: contributing identity and access controls (secrets management, workload identity, policy-as-code) to CI/CD pipelines.
Experience with non-human, workload, and AI-agent identity, secrets management, and machine-to-machine authentication.
Experience supporting compliance and audit requirements (SOC 2, ISO 27001, FedRAMP, HIPAA) from an identity and access control perspective.
Relevant certifications such as SC-300 (Microsoft Identity and Access Administrator), AZ-500 (Azure Security Engineer), Okta Certified Professional/Administrator, SailPoint IdentityIQ, SEC+, CISSP, CISA, or equivalent.
Relativity is committed to competitive, fair, and equitable compensation practices.
This position is eligible for total compensation which includes a competitive base salary, an annual performance bonus, and long-term incentives.
The expected salary range for this role is between following values:
$104 000 and $156 000The final offered salary will be based on several factors, including but not limited to the candidate's depth of experience, skill set, qualifications, and internal pay equity. Hiring at the top end of the range would not be typical, to allow for future meaningful salary growth in this position.
Required Skills:
Endpoint Security, Network Security, Penetration Testing, Security Architecture Design, Security Automation, Security Information, Security Information and Event Management (SIEM), Security Operations, Threat Modeling, Vulnerability ManagementFrequently Asked Questions
Is the salary disclosed for the Advanced Security Engineer (IAM) position at kcura?
Where is the Advanced Security Engineer (IAM) position at kcura located?
Is the Advanced Security Engineer (IAM) role at kcura full-time or part-time?
Which team or department does the Advanced Security Engineer (IAM) at kcura belong to?
How do I apply for the Advanced Security Engineer (IAM) position at kcura?
When was the Advanced Security Engineer (IAM) job at kcura posted?
You'll be redirected to kcura's official application page on Workday.