Identity Operations Engineer

Job Title: Identity Operations Engineer
Job Type: Contract
Duration: 6 Months
Location: Seattle, WA 98101
Hybrid role – 4 days onsite/week
Schedule: M-F (8-5)
100% Onsite role


About the Role:
Identity Operations Engineer — Access Lifecycle & Automation
We rely on Microsoft Entra ID and SailPoint Identity Security Cloud (ISC) to manage access across a hybrid, multi-cloud environment. We’re hiring an Identity Operations Engineer to resolve joiner, mover, and leaver (JML) requests, access requests, and provisioning issues, and to build the automation that eliminates repeat work.

This is a hands-on operations role, not an architecture role. Most of your time is spent working the identity ticket queue, troubleshooting provisioning and sync failures, and executing lifecycle changes accurately and on time. The rest is spent finding the tickets and manual steps that shouldn't exist and automating them away with PowerShell, Microsoft Graph, SailPoint ISC APIs, and workflow tooling. You'll work closely with Identity Architecture, HR, IT Service Management, application owners, and Security Operations, and you'll be the person the business relies on when access doesn't work the way it should. It's a strong fit for an engineer who enjoys solving real access problems for real people and has a bias toward scripting the fix instead of repeating it.
A Day in the Life

Identity Lifecycle Operations (Joiner / Mover / Leaver):

• Fulfill and resolve joiner, mover, and leaver requests from the ITSM queue within SLA — account creation, baseline and role-based access assignment, access changes for transfers and promotions, and timely, complete deprovisioning for terminations, contractors, and leaves of absence.
• Operate SailPoint ISC day to day — process access requests, investigate and remediate provisioning failures, monitor aggregations and identity refreshes, correct identity attribute and source-data issues, and manage role and access profile assignments.
• Administer Microsoft Entra ID — users, groups (including dynamic membership), license assignment, enterprise application role assignments, guest accounts, and Lifecycle Workflows and Entitlement Management access package requests.
• Troubleshoot HR-to-identity provisioning and hybrid sync issues — attribute mismatches, duplicate or conflicting accounts, and Entra Connect / Cloud Sync errors between Entra ID and on-premises Active Directory.
• Handle privileged and elevated access requests — Privileged Identity Management (PIM) eligible assignments, role-assignable and privileged groups — with the required approvals, justification, and audit trail.
• Support application access — SSO (SAML/OIDC) assignments, SCIM provisioning errors, and onboarding of applications and connectors to established patterns defined by Identity Architecture.
• Run access certification and access review campaigns operationally — launch, monitor, send reminders, and execute revocations — and produce audit evidence for internal and external audits (e.g., SOX, PCI).
• Perform ongoing account hygiene — orphaned, dormant, and stale accounts, guest cleanup, service account inventory, and reconciliation between Entra, SailPoint, and Active Directory.

• Build and maintain automation for lifecycle and access tasks using PowerShell, Microsoft Graph API / Graph PowerShell SDK, Python, and SailPoint ISC APIs, workflows, and rules.
• Create event-driven and scheduled workflows using tools such as Azure Automation, Logic Apps, Power Automate, or Azure Functions — including ITSM ticket integration for auto-fulfillment, status updates, and closure.
• Analyze ticket volume, SLA performance, and recurring failure patterns to identify the highest-value automation opportunities, and track results (tickets eliminated, time saved, error reduction).
• Treat automation as production code — source control, peer review, testing, logging, and error handling — so that scripts and workflows are repeatable, supportable, and safe to run against live identities.
• Use AI tooling to speed up scripting, log and error analysis, troubleshooting, and documentation.

• Write and maintain runbooks, SOPs, and knowledge base articles so that common identity issues can be resolved consistently by the broader support organization.
• Serve as an escalation point for the service desk and application teams, and partner with Identity Architecture to feed operational findings back into design and standards.
• Partner with HR/HRIS, IT Service Management, and Security Operations to improve source-data quality, lifecycle timing, and the identity signals available for threat detection.
• Participate in incident response and escalation coverage for identity-related issues, including after-hours support as needed.

• Bachelor's or master's degree in Computer Science, Cybersecurity, Information Technology, or equivalent education and experience.
• 3+ years in identity and access management, IAM operations, or systems/security engineering, including hands-on work with joiner/mover/leaver processes.
• Hands-on experience with Microsoft Entra ID — user, group, and application administration, plus working knowledge of Conditional Access, PIM, and Entra ID Governance features (Lifecycle Workflows, Entitlement Management, Access Reviews).
• Hands-on experience operating an enterprise IGA platform — SailPoint ISC / IdentityNow preferred; comparable experience with other IGA tools is considered — including access requests, provisioning, source connectors, and troubleshooting failed provisioning.
• Proven scripting and automation skills — PowerShell and Microsoft Graph API / Graph PowerShell SDK required; Python and REST API integration experience strongly valued.
• Working knowledge of authentication and provisioning protocols — SAML, OAuth 2.0, OIDC, SCIM — sufficient to troubleshoot SSO and provisioning issues.
• Experience with hybrid identity — on-premises Active Directory, Entra Connect / Cloud Sync — and troubleshooting synchronization and attribute issues.
• Experience working in an ITSM ticketing environment (e.g., ServiceNow), managing queues against SLAs, and documenting work to audit standards.
• Strong troubleshooting and problem-solving skills, attention to detail, and clear communication with both technical and non-technical partners.

• Certifications: Microsoft SC-300 (Identity and Access Administrator), SailPoint ISC certification, AZ-500, Security+, or CISSP.
• Experience building ITSM-integrated automation (e.g., ServiceNow to SailPoint or Entra fulfillment workflows).
• Experience with low-code/no-code automation (Power Automate, Logic Apps) and infrastructure-as-code or configuration-as-code (Terraform, Bicep).
• Familiarity with HRIS-driven provisioning (e.g., Workday) and source-of-truth data quality issues.
• Familiarity with privileged access management (e.g., BeyondTrust) and how PAM and PIM complement each other.
• Experience supporting audit and compliance requirements (SOX, PCI) for access controls and evidence collection.
• Exposure to identity threat detection and response (ITDR) and feeding identity signals into SIEM/SOAR.
• Large-scale retail, ecommerce, or other high-transaction enterprise experience