Principal IAM Engineer (Healthcare)

Location: Remote, USA. A Dallas, TX hybrid arrangement requiring three days in the office per week is also listed for other locations.

Company

hirify.global is a specialty care platform connecting members with nationwide specialist care while operating in a regulated healthcare environment involving HIPAA, HITRUST, SOC 2, and protected health information at scale.

What you will do

• Own the identity lifecycle, including joiner, mover, and leaver provisioning and deprovisioning using RBAC/ABAC models and entitlement-inventory verification.
• Design and operate Conditional Access, phishing-resistant MFA, privileged access, least privilege, JIT elevation, and Zero Trust controls.
• Own directory and federation across Microsoft Entra ID, SSO, SAML, OIDC, and OAuth2.
• Govern secrets and non-human identities, including API keys, service accounts, workload identity, and owner registries.
• Build identity automation, identity-as-code, policy-as-code, Terraform infrastructure, lifecycle workflows, and custom connectors.
• Set identity-verification standards for password resets, MFA resets, and device enrollment while coordinating with Service Delivery, Cloud Engineering, HR, and Governance, Risk & Compliance.

Requirements

• Eight or more years in identity and access management, including principal- or staff-level ownership of an identity control plane.
• Deep Microsoft Entra ID engineering experience covering Conditional Access, phishing-resistant MFA, SSO, SAML, OIDC, OAuth2, and verification across every access path.
• Identity lifecycle automation across cloud, SaaS, and privileged systems, including RBAC/ABAC provisioning and entitlement-inventory-based deprovisioning verification.
• Zero Trust identity design with least privilege, JIT access, and risk-based or adaptive access controls.
• IGA platform engineering, including privileged access management; experience with secrets, API keys, service accounts, workload identity, and owner registries.
• Automation and scripting with PowerShell, Python, or similar tools; identity-as-code and policy-as-code using Terraform and source-controlled change management such as GitHub.
• Key access governance and separation of duties where another team operates the key management system.
• Ability to act as technical authority without formal people-management responsibility, working directly with a CISO.
• Bachelor’s degree in a relevant field or equivalent professional experience.

Nice to have

• Healthcare or other regulated-environment experience where identity controls gate access to PHI.
• Hands-on Saviynt with PAM, Azure PIM, and Keeper, or comparable platform depth.
• Experience remediating Conditional Access enforcement gaps or deprovisioning failures through structural fixes.
• Passkeys, FIDO2, phishing-resistant authenticators, and alignment with NIST SP 800-63 Rev. 4.
• Experience expanding a technical scope into broader leadership responsibility.
• Microsoft Identity and Access Administrator certification, CIMP, or equivalent.

Culture & Benefits

• Open-by-default, secure-by-design approach with automated, transparent guardrails.
• Hands-on individual-contributor role with a potential path to leadership as the identity function grows.
• Medical, dental, and vision insurance; short- and long-term disability insurance; and life insurance.
• 401(k) with company match, flexible time off, and paid parental leave.
• Values include logic, inclusion, grit, humanity, truth, collaboration, and respect for independent governance.

Hiring process

• Apply for the role; the Talent Acquisition team will contact candidates to discuss the interview process.