Identity and Access Analyst (IAM)

Business Area:

IT

Seniority Level:

Mid-Senior level

Job Description:

At Cloudera, we empower people to transform complex data into clear and actionable insights. With as much data under management as the hyperscalers, we're the preferred data partner for the top companies in almost every industry.  Powered by the relentless innovation of the open source community, Cloudera advances digital transformation for the world’s largest enterprises.

The Infrastructure and Operations organisation within Cloudera IT delivers a reliable, secure and scalable service infrastructure for our users and applications. Identity is the control plane for all of it, from SaaS applications to thousands of cloud accounts across AWS, Azure and Google Cloud. We partner with Information Security to build a Zero Trust architecture across Cloudera, and we support engineering teams enabling identity and SSO for in-house applications.

We are looking for an Identity Engineer to join our Infrastructure Operations team. You will help us run Okta as code, automate the identity lifecycle, and put the structure in place that makes least-privilege and just-in-time access work in practice, while keeping systems easy for people to use. You will work closely with our identity engineer, Information Security, HR systems and our support teams.

This role is not eligible for immigration sponsorship.

As an Identity Engineer, you will:

• Own delivery of identity projects, and contribute to identity architecture decisions with other teams.
• Administer and improve our Okta environments, including groups, group rules, policies, authenticators and application integrations.
• Build and maintain identity configuration as code using Terraform and CI/CD, and review identity change requests from other engineers.
• Design and build tooling and automation that enables secure self-service under Zero Trust principles, including Okta Workflows and scripted integrations.
• Ensure auditability of identity functions, including configuration backup, change tracking and logging to central systems.
• Design and automate identity lifecycle processes, from joiner through mover to leaver, driven by our HR system of record.
• Onboard applications to our access request and just-in-time access platform, replacing manual and standing permissions with request-based workflows.
• Bring an existing Okta estate into line with our group naming and lifecycle standards, including remediating legacy groups, direct role assignments and stale accounts.
• Work with HR systems to manage the downstream impact of organisational changes on groups and access.
• Support identity federation into AWS, Azure and Google Cloud.
• Weigh risk against business and user needs, so access is both secure and easy to use.
• Write clear runbooks and documentation.
• Take part in an on-call rotation for identity services.

We're excited about you if you have:

• 6+ years of experience operating and deploying Okta or an equivalent identity provider.
• Strong experience with authentication protocols and systems, including OIDC, SAML and SCIM, and AD or LDAP.
• Experience with access governance or JIT platforms such as Lumos, SailPoint or ConductorOne.
• Experience building integrations and automation against web service APIs in Python, Go or JavaScript.
• Experience with infrastructure as code, ideally Terraform, in a CI/CD environment such as GitHub, Spacelift or Jenkins.
• Experience working with other teams on identity changes that affect many users.
• Experience securing automation that holds privileged access, including separation of read and write functions and secrets management.
• A methodical approach to change, and a habit of documenting what you build.
  

You may also have:

• Okta Certified Professional, Administrator or Consultant certification.
• Experience with Okta Workflows.
• Experience with AWS IAM Identity Center or multi-account cloud access.
• Experience integrating an identity provider with an HR system such as Workday.
• Experience with Active Directory, RADIUS, OpenLDAP or TACACS.
• Experience building for compliance, such as SOC 2 or SOX.
• A working understanding of Zero Trust architecture.

What you can expect from us:

• Generous PTO Policy 

• Support work life balance with Unplugged Days

• Flexible WFH Policy 

• Mental & Physical Wellness programs 

• Phone and Internet Reimbursement program 

• Access to Continued Career Development 

• Comprehensive Benefits and Competitive Packages 

• Paid Volunteer Time

• Employee Resource Groups

EEO/VEVRAA

#LI-RB1

#LI-REMOTE