CSI GLOBAL LTD
IAM Engineer
London
Posted about 15 hours ago
Get notified of more jobs like this · No spam, ever
How your CV stacks up
1Upload CV
2Analyse CV
3Improve CV
Upload your CV to see how well it fits this job role
?%
Role: IAM Engineer
Location: London, UK - (1-2 days/week office)
Type: Contract-Inside IR35
Job Description
Senior IAM Engineer to support IAM service transition privileged access transformation and identity security improvements across Entra ID, Active Directory, CyberArk, and ServiceNow. The role will drive operational handover, strengthen access controls, and improve governance across both human and nonhuman identities. Capable of critical thinking, constructively challenging ideas, and working independently to a high standard.
Key Responsibilities
IAM Service Transition Operations
- Support handover of IAM BAU operations into a centralized IAM function
- Define IAM service scope, operating model, and RACI across support teams
- Drive transition planning, resource onboarding, and knowledge transfer
- Create/update SOPs, process documentation, and operational runbooks
- Configure and optimize ServiceNow groups, workflows, and ticket routing
- Define and track IAM operational metrics, KPIs, and reporting
Privileged Access Management Entra PIM
- Implement Just-In-Time (JIT) privileged access using Entra PIM
- Migrate standing access to eligible role-based access via groups
- Configure approval workflows and Tier-based access controls (incl. Tier 0)
- Implement and manage break-glass accounts with monitoring and controls
- Support access recertification and removal of overpermissioned access
- Define and manage Entra-only privileged account model and lifecycle
- Build ServiceNow request workflows for privileged access requests
Conditional Access Transformation
- Assess and baseline existing Conditional Access policies and risks
- Redesign into a secure, simplified, and governed CA model
- Enforce controls including:
- MFA, phishing-resistant
- Compliant hybrid joined devices
- Risk-based access controls
- Rationalize exceptions, exclusions, and service account access
- Support testing, phased rollout, and governance model implementation
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Identity Security Hygiene
- Remediate weak AD passwords, user service accounts
- Implement automated user notification and forced reset mechanisms
- Support non-production password risk remediation
- Improve controls to prevent weak passwords going forward
CyberArk PAM Enhancements
- Strengthen CyberArk policies and privileged session controls
- Prevent direct access bypass of vaulted credentials
- Enhance monitoring and logging for privileged access activity
- Perform account discovery and improve vaulting coverage
- Clean up orphaned, invalid, and leaver-related accounts and safes
- Implement processes for ongoing CyberArk hygiene and lifecycle management
Service Accounts Non-Human Identities (NHI)
- Review and secure AD service accounts, remove unnecessary interactive login
- Assess and govern NHI landscape (gMSA, certificates, secrets, etc.)
- Improve credential storage, ownership, and lifecycle controls
- Strengthen governance of:
- Service principals
- Managed identities
- Application registrations
- Reduce dependency on shared secrets and unmanaged credentials
Emerging Identity Areas AI Workload Identities
- Assess AI agents and automation workflows for identity risks
- Review access models, delegated permissions, and data exposure
- Recommend controls for secure and governed agentic access
Required Skills
- Strong hands-on experience in IAM, PAM engineering
- Expertise in:
- Microsoft Entra ID, Azure AD
- PIM (Privileged Identity Management)
- Conditional Access
- Active Directory (AD)
- Experience with CyberArk or equivalent PAM tools
- Experience working with ServiceNow ITSM workflows, request management
- Good understanding of:
- JIT access, least privilege
- Tiered admin model (Tier 0-1-2)
- Identity governance, access reviews
- Service accounts, nonhuman identities
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Good to Have
- Experience in IAM service transition setup
- Exposure to audit, compliance, and recertification processes
- Knowledge of OAuth, certificates, workload identity security
- Relevant certifications (SC300, CyberArk, CISSP, etc.)
Experience
- 6-10 years in IAM, Cyber Security
- Strong hands-on implementation experience required
- IAM, IGA Operations Analyst related activities
- Perform routine PowerShell-based operational scripts for standard reporting, data extraction, and repeatable IAM housekeeping tasks as per approved runbooks
- Execute identity hygiene activities such as user, group, application, and service principal cleanup based on predefined procedures and approval
- Support orphaned account identification and remediation activities by running standard reports and executing approved corrective actions
- Assist with removal or remediation of legacy authentication methods by executing predefined changes and remediation steps approved by IAM engineering or security team
- Provide operational support for SSO, MFA, and federation platforms including incident handling, service requests, monitoring, and routine maintenance
- Implement pre-approved authentication and access control policies
Trusted by 25,000+ job seekers
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Location