Senior Identity Security Engineer (Security Engineer III)

About the role

As a Senior Identity Security Engineer at Anaplan, you will be a hands‑on contributor to the company’s identity security function, supporting a global customer base that includes Fortune 50 firms. You will work within a collaborative security team to mature the Identity Governance and Administration (IGA) platform, build out Privileged Access Management (PAM), and govern non‑human and AI agent identities as part of a Zero Trust strategy.

Key responsibilities

• Administer and develop Anaplan’s IGA platform (SailPoint), covering the full identity lifecycle, connector configuration, role modeling, and access certification.
• Evaluate, select, and implement a PAM solution, including privileged account discovery, vaulting, just‑in‑time access, session monitoring, and credential rotation.
• Design governance frameworks for non‑human identities such as service accounts, API keys, certificates, and OAuth tokens, integrating with secrets‑management tools.
• Provide technical guidance for AI agent identity security, defining authentication, authorization, and lifecycle policies.
• Automate provisioning, de‑provisioning, and access request workflows using scripting and integration tools.
• Support access governance, separation‑of‑duties policies, audit reporting, and compliance programmes (SOC 2, ISO 27001).

Required profile

• Extensive hands‑on experience administering an enterprise IGA platform, preferably SailPoint (IdentityNow or IdentityIQ).
• Strong knowledge of PAM concepts and experience contributing to a PAM programme from inception.
• Experience managing non‑human identities at scale and familiarity with secrets‑management solutions (e.g., HashiCorp Vault, AWS Secrets Manager).
• Understanding of identity challenges for AI agents and automated workflows.
• Proficiency with core identity protocols (SAML 2.0, OAuth 2.0, OIDC, SCIM, LDAP, Kerberos) and cloud IAM platforms (AWS IAM, Microsoft Entra ID, GCP IAM).

Required skills

• SailPoint (IdentityNow/IdentityIQ)
• Privileged Access Management (PAM)
• HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, CyberArk Conjur
• SAML 2.0, OAuth 2.0, OIDC, SCIM, LDAP, Kerberos
• AWS IAM, Microsoft Entra ID, GCP IAM
• Python, PowerShell, Java/BeanShell