security engineer in IAM security

EPAM is a global leader in AI transformation engineering and integrated consulting, serving Forbes Global 2000 companies and ambitious startups. With over thirty years of expertise in custom software, product, and platform engineering, it helps clients become AI-Native enterprises and drive measurable value from innovation and digital investments.

• Implement, configure, and operate IAM solutions and controls based on architectures, standards, and designs defined by IAM architects and security leadership
• Build and maintain identity lifecycle processes, including automated provisioning and deprovisioning across target systems
• Configure and maintain SSO, federation, MFA, passwordless authentication, conditional access, RBAC/ABAC role models, and least-privilege access
• Develop, deploy, and maintain IAM integrations and connectors with cloud platforms, SaaS applications, enterprise systems, directories, authoritative source systems, databases, and APIs
• Execute access certification and review campaigns, clean up entitlements, and configure SoD rules according to policies defined by architects and the business
• Operate PAM controls, including credential vaulting, secrets rotation, session management, and just-in-time and just-enough access
• Develop and maintain automation scripts, workflows, and IAM tooling using PowerShell, Python, REST APIs, SCIM, Terraform, or similar technologies
• Monitor IAM platform health, troubleshoot and resolve incidents and access issues, and perform patching, upgrades, and configuration hardening
• Maintain IAM logging, alerting, and monitoring, and run backup and recovery procedures according to defined runbooks and resilience requirements
• Build, deploy, and maintain AI-assisted automations and agentic workflows that reduce manual effort across daily IAM operations, including access request triage, entitlement analysis, anomaly detection, provisioning troubleshooting, privileged access review support, compliance evidence collection, and runbook generation
• Integrate AI agents and LLM-backed automations into IAM systems and operational pipelines, connecting models to internal tools, APIs, directories, ticketing, and IAM platforms via function calling, SCIM, REST, and webhooks
• Design, test, and maintain reusable prompts, structured-prompting patterns, and prompt templates for recurring IAM tasks, tuning them for accuracy, consistency, and safe behavior
• Deploy retrieval over IAM policies, role catalogs, runbooks, and documentation, and implement output verification, human-in-the-loop approval gates, rollback paths, and security and privacy controls for IAM AI usage
• Track AI-assisted IAM automations in production, measure their accuracy and impact, and continuously tune prompts, tools, and workflows based on results and feedback
• Produce and maintain operational documentation, runbooks, and standard operating procedures, and support audits and compliance evidence requests

• Bachelor’s degree in Computer Science, Cybersecurity, Engineering, or equivalent practical experience
• At least 2 years of hands-on experience implementing or operating IAM solutions, including hands-on experience with at least one enterprise IAM, IGA, PAM, or federation platform
• Understand IAM concepts, including identity lifecycle, authentication, authorization, SSO, federation, MFA, RBAC/ABAC, least privilege, and privileged access
• Know common IAM protocols and standards, including SAML, OAuth 2.0, OpenID Connect, SCIM, LDAP, and Kerberos
• Have expertise configuring IAM controls, policies, connectors, and access governance workflows
• Be familiar with cloud IAM concepts on at least one major cloud platform, such as Azure, AWS, or GCP
• Have scripting and automation skills in at least one of PowerShell, Python, or Bash, as well as REST APIs, SCIM, or Terraform
• Be able to work closely with developers, architects, infrastructure engineers, security operations, compliance teams, and business stakeholders, and follow, maintain, and improve defined IAM and security processes
• Be comfortable executing changes from tickets, runbooks, and designs provided by senior engineers and architects, and escalating design-level questions rather than owning them
• Have practical understanding of AI-assisted productivity and automation beyond basic chatbot usage, including building or configuring AI agents, automating repetitive IAM or security tasks, integrating LLMs with tools, APIs, and workflows, prompt engineering, and securely using AI tools with awareness of sensitive identity data
• Have strong communication skills and be able to explain IAM issues, technical decisions, and remediation steps to technical and non-technical stakeholders
• English proficiency at Upper-Intermediate level (B2) or higher
• Будет плюсом: experience with Microsoft Entra ID, Active Directory, Okta, Ping Identity, ForgeRock, Auth0, SailPoint, Saviynt, or CyberArk; experience with CIAM, B2B/B2C identity, customer identity, external identity, or partner access scenarios, and SIEM/SOAR integrations for IAM monitoring, alerting, and automated response; proficiency in CI/CD-based IAM deployment, configuration-as-code, and automated testing of IAM changes; familiarity with Azure OpenAI, Amazon Bedrock, Microsoft Copilot Studio, LangChain, AutoGen, or Power Automate, and understanding of AI security risks including data leakage, prompt injection, and excessive agency; security or IAM certifications such as SC-300, Okta Certified Professional/Administrator/Consultant, SailPoint, Saviynt, CyberArk, or Ping Identity certifications, CISSP, CISM, CISA, CCSK, CCSP, SSCP, AI-900, or AWS Certified AI Practitioner

• Opportunity to work abroad for up to two months per year
• Relocation opportunities within EPAM offices in 55+ countries
• Corporate and social events
• Leadership development, career advising, soft skills, and well-being programs
• Certifications, including GCP, Azure, and AWS
• Unlimited access to EPAM's internal learning database
• Free English classes with certified teachers
• Discounts at local language schools, including offline Uzbek courses
• Monetary bonuses for participating in the referral program
• Medical and family care package
• Four trust days per year (sick leave without a medical certificate)
• Discounts for fitness clubs, dance schools, and sports programs
• Benefits package covering sports activities and a variety of stores and services