Workforce IAM Engineer

Design, Build, and Maintain: Persona-Based Access (RBAC) (50%) • Build, test, deploy, and maintain RBAC roles and access policies as new applications and personas are added to the program • Develop and evolve application logic and automations using well-architected, scalable design patterns • Build and maintain Microsoft Entra ID and Okta integrations and workflows, including application onboarding, SSO/SCIM configuration, and automation via Microsoft Graph and Okta APIs • Write and maintain scripts and tooling (e.g., PowerShell) to automate role assignment, access provisioning, and reporting workflows • Maintain existing RBAC roles as organizational structures, entitlements, and applications change over time • Write, test, and document code according to team standards, including unit tests, and perform code reviews to help identify patterns for improvement Operate and Maintain: Password Management and Hardware Security Keys (30%) • Administer the enterprise password management platform: vault structure, policies, group and SCIM provisioning, onboarding/offboarding, and version upgrades • Support the hardware security key lifecycle: provisioning and enrollment, replacements, PIN resets, and lost/damaged key recovery • Coordinate with Asset Management on shipping logistics for hardware security key distribution to end users and reclamation upon offboarding, replacement, or role change • Monitor platform health, apply updates, and coordinate with vendors on issues as they arise • Contribute to runbooks, documentation, and knowledge-based articles that reduce repeat issues and improve team efficiency

At College Board, we offer more than just a paycheck—we provide a meaningful career, a supportive team, and a comprehensive package designed to help you thrive. We’re a self-sustaining nonprofit that believes in fair and competitive compensation, grounded in your qualifications, experience, impact, and the market.

College Board – Technology – Workforce IAM Location: This is a remote role. Candidates who live near CB offices have the option of being fully remote or hybrid (Tuesday and Wednesday in office). All CB employees are required to occasionally travel to meet in person for business purposes. Role Type: This is a full-time position About the Team The Workforce Identity and Access Management (WIAM) team is the identity control plane for College Board's enterprise. The team owns the full workforce identity lifecycle, from onboarding and provisioning through access governance, certification, and offboarding, and operates the platforms that enforce authentication, authorization, and privileged access management across the organization. WIAM's work spans six capability pillars: identity onboarding, provisioning, authentication and authorization, credential management, access certification, and identity offboarding. The team is the primary owner of College Board's enterprise IGA platform and PAM infrastructure, and it partners closely with Talent, ISGRC, and security peer teams to ensure identity services are reliable, auditable, and aligned to Zero Trust principles. The team operates at the intersection of security rigor and user experience; the controls WIAM builds directly affect how every College Board employee accesses systems and data every day. As College Board's workforce has grown and its cloud and SaaS footprint has expanded, WIAM's scope has grown to match: centralizing more applications, automating more lifecycle actions, and governing an increasingly complex mix of human and non-human identities. About the Opportunity As a Workforce IAM Engineer on the WIAM team, you are a proactive, self-directed identity engineer who tries a fix before asking for one. You bring real depth in Microsoft Entra ID, Active Directory, and Okta, and you spot what could be better before anyone complains. You will play a hands-on role keeping identity access secure and reliable across a mix of cloud and hybrid platforms at enterprise scale, where clean role design, dependable provisioning, and strong documentation directly support College Board's Zero Trust strategy. This role exists to carry WIAM's persona-based RBAC rollout forward and keep our standing identity platforms running well. With guidance from senior engineers, you will independently design, build, and ship pieces of the rollout, application by application and role by role, while owning day-to-day administration of our enterprise password management and hardware security key platforms. You will partner closely with senior WIAM engineers, security architects, and the application teams onboarding to Entra ID and Okta to keep access moving without last-mile friction for end users. Success in this role means personas and applications onboarded on schedule, password and hardware key platforms that hold up under real operational load, and identity access that keeps pace as College Board grows. In this role, you will: Design, Build, and Maintain: Persona-Based Access (RBAC) (50%) • Build, test, deploy, and maintain RBAC roles and access policies as new applications and personas are added to the program • Develop and evolve application logic and automations using well-architected, scalable design patterns • Build and maintain Microsoft Entra ID and Okta integrations and workflows, including application onboarding, SSO/SCIM configuration, and automation via Microsoft Graph and Okta APIs • Write and maintain scripts and tooling (e.g., PowerShell) to automate role assignment, access provisioning, and reporting workflows • Maintain existing RBAC roles as organizational structures, entitlements, and applications change over time • Write, test, and document code according to team standards, including unit tests, and perform code reviews to help identify patterns for improvement Operate and Maintain: Password Management and Hardware Security Keys (30%) • Administer the enterprise password management platform: vault structure, policies, group and SCIM provisioning, onboarding/offboarding, and version upgrades • Support the hardware security key lifecycle: provisioning and enrollment, replacements, PIN resets, and lost/damaged key recovery • Coordinate with Asset Management on shipping logistics for hardware security key distribution to end users and reclamation upon offboarding, replacement, or role change • Monitor platform health, apply updates, and coordinate with vendors on issues as they arise • Contribute to runbooks, documentation, and knowledge-based articles that reduce repeat issues and improve team efficiency Analysis and Support (20%) • Review requirements and identify design considerations, providing feedback on the design and implementation of features • Analyze authentication, authorization, and access data to support troubleshooting, audits, and continuous improvement • Troubleshoot and resolve application access issues, authentication errors, and integration failures, escalating as appropriate • Support end users and partner teams on identity-related requests, RBAC questions, and platform features • Participate in the team's on-call rotation, responding to identity platform incidents and following established escalation procedures About You To qualify for this role, you must have: • 3+ years of IT engineering experience, including at least 1 year administering an enterprise password management platform (1Password preferred; Keeper and Bitwarden also considered) • Hands-on experience with Active Directory, Microsoft Entra ID, and Okta, including application onboarding and SSO/SCIM configuration • A strong understanding of hardware security tokens such as YubiKey, Google Titan, and Feitian • Working knowledge of identity and access management concepts such as role-based access control (RBAC), SSO, SAML/OIDC, and MFA • Scripting experience with PowerShell, Python, or both, ideally including automation through the