Join EY as an IAM Secure Access Engineer and play a crucial role in protecting information assets in our data-driven world. This position is key to enabling secure business operations and the responsible adoption of cutting-edge AI technologies like Generative AI and AI Agents. You'll contribute to a global team focused on blending risk strategy, digital identity, cyber defense, and technology solutions to safeguard enterprise systems, data, and digital assets.

This role focuses on designing, governing, and securing AI identities and access controls, establishing robust security frameworks aligned with Zero Trust principles and emerging AI governance standards. By specializing in AI-focused identity security, you will significantly reduce organizational risk and strengthen compliance.

Design, implement, and maintain identity governance frameworks for AI agents, machine identities, and Generative AI platforms, including lifecycle management processes. Configure and support authentication, federation, and access controls using modern protocols and tools like SAML, OAuth 2.0, OpenID Connect, Microsoft Entra ID, PingID, Okta, and PlainID. Implement and enhance Conditional Access policies, MFA, single sign-on, and passwordless authentication solutions. Develop and enforce policies for AI agent access to enterprise systems, APIs, and sensitive data, ensuring AI systems operate within defined boundaries. Create technical designs, implementation plans, and test cases for secure solutions, and manage the change process through to production deployment. Automate administrative tasks and participate in incident response, vulnerability remediation, and continuous improvement activities.

A degree in Computer Science, Information Technology, Cybersecurity, or equivalent practical experience is required, along with 3 to 5 years of experience in IAM, authentication engineering, or security engineering.

Key skills include a solid understanding of authentication, authorization, identity federation, MFA, SSO, and Zero Trust principles. You should have hands-on experience with at least two of the following: Microsoft Entra ID, PingID, PingFederate, PingAccess, Okta, or PlainID.

Proficiency in SAML, OAuth 2.0, OpenID Connect, JWT, SCIM, and scripting languages like PowerShell is essential. Experience with Conditional Access, Identity Protection, workload identities, and modern authentication controls is also required. Strong troubleshooting, documentation, testing, and stakeholder communication skills are vital for success in this role.