Job Title: Senior Identity and Access Management (IAM) Engineer

Location: Fully Remote Role Canada

Duration: 6-9 Months Contract with Possible Extension

Pay Range: $100-$110 CAD Per Hour on T4

Role Overview

We are seeking a highly skilled Identity and Access Management (IAM) Engineer for a 6 to 9-month contract to support our secrets management program. This initiative focuses on migrating and enhancing our enterprise Secrets Management and Privileged Access posture using Client Privileged Access (OPA).

While OPA provides a robust foundation for our security needs, several complex business requirements necessitate custom development. As the IAM Engineer on this project, you will be responsible for designing, developing, and deploying custom scripts and Client Workflows to bridge these functional gaps. You will work closely with the IAM and Sec-GRC teams to build out automated workarounds for SaaS auto-rotation, lifecycle management, compliance reporting, and access attestations.

Key Responsibilities

• Custom Workflow Development: Design and build complex Client Workflows to fulfill enterprise governance requirements that fall outside of OPA's native capabilities.

• SaaS Account Automation: Develop custom scripts and API integrations to automate credential rotation for non-federated local SaaS accounts and connected apps (e.g., Salesforce ECAs, Snowflake Key Pair Auth, Workday), leveraging vendor APIs.

• Lifecycle & Alerting Orchestration: Build workflows triggered by Client Lifecycle Management (LCM) events to manage orphaned secrets, dynamically look up manager routing, and trigger custom multi-interval expiration notifications (e.g., T-60, T-30) via Slack, Teams, or Email.

• Compliance & Governance Reporting: Develop automated solutions to extract secrets metadata via the OPA API, generating custom CSV exports and populating external tracking dashboards for rotation success rates, overdue secrets, and orphaned accounts.

• Attestation & Exception Tracking:



Orchestrate hybrid attestation campaigns by integrating OPA metadata with Client Identity Governance (OIG) and ITSM tools (like Jira) to facilitate annual secret owner reviews and rotation exception logging.

• API & Scripting Execution: Utilize strong coding skills to interact with Client APIs, OPA REST endpoints, and third-party systems to ensure seamless secrets vaulting and attribute tracking.

Required Qualifications

• Extensive IAM Expertise: Robust background in Identity and Access Management (IAM), including Privileged Access Management (PAM), Secrets Management, Non-Human Identity (NHI) governance, Just-in-Time (JIT) access, and Zero Standing Privileges (ZSP).

- Deep hands-on experience with Client Workforce Identity Cloud (WIC), Client Privileged Access (OPA), Client Identity Governance (OIG), and Identity Governance Administration (IGA) concepts.

• Client Ecosystem Mastery: Deep, hands-on administrative expertise with Client Workforce Identity Cloud (WIC), Client Privileged Access (OPA), and Client Identity Governance (OIG).

- Advanced Client Workflows: Proven track record of building, testing, and deploying complex, multi-step Client Workflows for orchestration and automation.
- Strong Coding/Scripting Background: High proficiency in scripting languages (e.g., Python, Node.js, Bash) and working with RESTful APIs, JSON, and webhooks to build custom integrations and programmatic workarounds.

• Security Framework Knowledge: Solid understanding of industry security and compliance frameworks (e.g., SOC 2, ISO 27001, NIST) and how they apply to privileged credential handling, audit logging, and access attestations.

- Problem-Solving Skills: Ability to analyze product limitations and engineer scalable, secure, and well-documented workarounds.

Preferred Qualifications

- Familiarity with SIEM integrations for audit logging.
- Experience dealing with workload identities and runtime secret injection.
- Prior experience acting in a security engineering capacity within an enterprise environment

📌 Senior IAM Engineer (Canada)
🏢 Vertisystem (A MOURI Tech
📍 Canada