Sr Engineer, IAM

About the Company

Interactive Brokers Group, Inc. (NASDAQ: IBKR), a member of the S&P 500, is a global financial services company headquartered in Greenwich, Connecticut, with offices in over 15 countries. Through its affiliates, Interactive Brokers provides automated trade execution and custody of securities, commodities, foreign exchange, and prediction markets on over 170 markets in numerous countries and currencies.

For more than four decades, Interactive Brokers has focused on technology, automation, and innovation to provide clients worldwide with a sophisticated, unified platform to manage their investment portfolios. We serve individual investors, hedge funds, proprietary trading groups, financial advisors, and introducing brokers.

Our culture is driven by problem-solving, efficiency, and continuous improvement. We look for individuals who are intellectually curious, collaborative, and motivated to contribute to technology that helps simplify and enhance access to global financial markets. Interactive Brokers has consistently been recognized as a top broker by respected industry sources including Barron's, Investopedia, Stockbrokers.com, and others.

About the role -

As a Senior IAM Engineer, you will be a key member of the Enterprise IT organization, serving as a senior hands-on engineer responsible for the design, implementation, and operation of our enterprise-wide Identity and Access Management program.

The role will be responsible for engineering and delivering IAM solutions across Identity Governance and Administration (IGA), Identity Providers (IdP/SSO), Privileged Access Management (PAM), and directory services. You will help bring together a complex, distributed identity environment, including Active Directory, Microsoft Entra ID, LDAP/OpenLDAP, SaaS applications, and enterprise platforms, into secure, scalable, automated, and supported identity workflows. The responsibilities include building automation, API-driven integrations, and lifecycle provisioning workflows; serving as a senior technical authority for architecture decisions and escalated engineering issues; driving integration across platforms such as Dayforce, M365, and ServiceNow; providing technical mentorship to other engineers; and collaborating with security, IT, HR, and business stakeholders to translate requirements into engineering deliverables.

We are seeking a well-rounded IAM engineer with strong identity fundamentals, broad integration experience, and the ability to apply those skills across evolving technologies. The successful candidate will have deep expertise in enterprise IAM platforms and protocols and will be comfortable assessing existing identity environments, defining target-state architecture, designing practical integration patterns, building automation, and operationalizing solutions through documentation, monitoring, support processes, and continuous improvement.

What will you do:

• Design, build, and deliver IAM engineering solutions including IGA, IdP/SSO, PAM, and directory services implementations.
• Assess and help rationalize complex identity environments, including distributed Active Directory domains, Entra ID, LDAP/OpenLDAP deployments, application directories, and legacy identity integrations.
• Develop target-state identity architectures and integration patterns that support cohesive joiner-mover-leaver lifecycle processes, secure access, data quality, and operational scalability.
• Configure and support IGA capabilities such as identity profiles, authoritative sources, account correlation, attribute mappings, transforms, lifecycle states, sources/connectors, access profiles, roles, entitlements, access requests, approvals, certifications, and separation-of-duties controls.
• Design, implement, and troubleshoot lifecycle provisioning and deprovisioning workflows across HR systems, directories, SaaS applications, databases, collaboration platforms, and IT service-management tools.
• Develop, test, and deploy identity automation, API-driven integrations, and lifecycle provisioning workflows
• Build and maintain IAM configuration promotion and development workflows, including source control, peer review, testing, release management, and platform-specific tooling such as SailPoint Configuration Hub, SP-Config, SDKs, or equivalent tools.
• Design and maintain RBAC models, including role discovery, role design, entitlement mapping, access-profile design, role lifecycle management, and ongoing troubleshooting of access outcomes.
• Configure and support IdP/SSO integrations using SAML, OAuth 2.0, OpenID Connect (OIDC), SCIM, and, where needed, WS-Federation and LDAP-based authentication patterns.
• Engineer and support PAM capabilities, including privileged account onboarding, reconciliation, password rotation, verification, decommissioning, safe/vault access controls, approval workflows, least-privilege access, and separation of duties.
• Integrate PAM platforms with Active Directory/LDAP, MFA, ticketing platforms, SIEM tools, cloud services, CI/CD pipelines, and identity governance solutions.
• Automate privileged-account onboarding, reporting, health checks, credential operations, and operational tasks through PowerShell, Python, REST APIs, and related tooling.
• Serve as a hands-on senior technical resource for complex architecture decisions, design reviews, and escalated engineering issues.
• Diagnose and resolve identity-related issues involving aggregation, provisioning, correlation, authentication, SSO, MFA, directory synchronization, access requests, certifications, privileged credential rotation, session access, and connector or platform health.
• Support SLAs, incident response, and root-cause analysis for IAM infrastructure.
• Develop and maintain engineering runbooks, documentation standards, and disaster recovery procedures for identity systems.
• Champion automation-first approaches to reduce manual effort across access provisioning, certification, and onboarding workflows.
• Provide technical guidance, code review, and mentorship to other engineers on the IAM team.
• Partner with security, IT, HR, and business stakeholders to gather requirements and translate them into engineering deliverables.

What you will need to have:

• Bachelor's degree or equivalent in Computer Science, Engineering, or related field.
• Minimum 5 years of hands-on experience in IAM engineering.
• Hands-on expertise with enterprise IAM platforms across IGA, IdP/SSO (e.g., Okta, Entra ID), PAM, directory services, lifecycle management, and access governance.
• Strong understanding of IAM fundamentals, including authentication, authorization, RBAC, ABAC concepts, least privilege, separation of duties, access reviews, joiner-mover-leaver processes, identity data management, and privileged access controls.
• Experience implementing or supporting an IGA platform, preferably SailPoint Identity Security Cloud or a comparable enterprise IGA solution.
• Experience with IGA capabilities such as authoritative-source integration, account aggregation, correlation, identity profiles, attribute mappings, provisioning, access requests, approvals, certifications, access profiles, roles, entitlements, and lifecycle workflows.
• Strong knowledge of standards and protocols such as OAuth 2.0, OIDC, SAML 2.0, and SCIM.
• Experience configuring and troubleshooting SSO, provisioning, MFA, directory synchronization, conditional/adaptive access controls, and application integrations in platforms such as Microsoft Entra ID, Okta, or equivalent IdPs.
• Experience with a PAM platform, preferably CyberArk or an equivalent enterprise solution, including privileged-account lifecycle management, safe/vault administration, platform and policy configuration, credential rotation, reconciliation, and session management.
• Proven experience building REST API-driven identity integrations and lifecycle automation using Python, PowerShell, Java, or similar languages in orchestration platformes such as Okta Workflows, Gitlab, Jenkins or similar.
• Experience using APIs, scripting, and automation to manage IAM configurations, perform reporting, conduct health checks, and reduce operational overhead.
• Experience with directory services administration and governance, including Active Directory, OpenLDAP, and cloud-based IdPs.
• Solid understanding of identity data management, including attribute normalization, identity matching and correlation, duplicate identity resolution, data-quality remediation and database connectivity concepts (e.g., PostgreSQL, JDBC/ODBC).
• Demonstrated ability to manage competing priorities, deliver under pressure, and lead complex technical workstreams.
• Strong written and verbal communication skills; able to explain technical concepts to diverse audiences.

What would be nice to have:

• Direct experience with SailPoint Identity Security Cloud, including tenants, identity profiles, transforms, sources, workflows, lifecycle states, access governance, APIs, Configuration Hub, SP-Config, SDKs, or related development tooling.
• Direct experience with CyberArk administration, including Digital Vault, PVWA, CPM, PSM, safes, platforms, account management, privileged sessions, and integrations.
• Direct experience with Okta administration, including Universal Directory, Lifecycle Management, group rules, application integrations, MFA, sign-on policies, Okta Workflows, APIs, Terraform, and SCIM provisioning.
• Experience in regulated industries such as financial services, healthcare, etc.
• Familiarity with Zero Trust principles and their application to identity and access controls.
• Industry certifications such as CISSP, CISM, or vendor-specific IAM credentials (e.g., Okta Certified Professional).

Company benefits:

• Competitive salary, annual performance-based bonus, and stock grant awards
• 401(k) retirement plan with competitive company match
• Excellent health and wellness benefits, including medical, dental, and vision benefits. 100% employer-paid medical premiums, with generous employer contributions to dental & vision plans as well.
• Wellness screening and assessments, health coaches, and counseling services through an Employee Assistance Program (EAP)
• Generous paid parental leave (up to 16 weeks paid parental leave for eligible employees)
• Company-paid basic life insurance, accidental death & dismemberment (AD&D), and short- and long-term disability coverage
• Flexible Spending Accounts (Healthcare, Dependent Care, and Commuter FSAs)
• Quarterly fitness stipend to offset costs associated with traditional gym and fitness memberships or fees
• Education reimbursement and professional development opportunities
• Legal services, telehealth access, and voluntary insurance options
• Backup child and adult care support through Care.com
• Daily lunch allowance and fully stocked kitchen with healthy breakfast and snack options