IAM & AI Engineer (Identity and Access Management)

We’d all like amazing work to do, and real work-life balance. That’s waiting for you at Sainsbury’s. Think about the scale it takes for us to feed the nation. The level of data, transactions and variety it involves. Then you’ll realise that ours is a modern software engineering environment because it has to be. We’ve made serious investment into a Tech Academy and into setting standards and principles. We iterate, learn, experiment and push ways of working such as Agile, Scrum and XP. So you can look forward to awesome opportunities in everything from AI to reusable tech.

Identity and Access Management Engineer

• Practical experience in Identity & Access Management (IAM) principles including authentication, authorisation, Access control models (RBAC / ABAC / PBAC), identity lifecycle management (Joiners / Movers / Leavers) and an awareness of Zero Trust.
• Working knowledge of AI-driven or data-led initiatives within IAM or cybersecurity, with an understanding of how analytics can support identity security and governance.
• Ability to analyse identity telemetry (audit logs, sign-in logs, access data) to support investigations, identify trends, and contribute to operational and security improvements.
• Hands‑on experience with Microsoft Entra ID (Azure AD), including:
• User and group management (static and dynamic groups)
• Role assignments, service principals, and application registrations
• Familiarity with tenants, directories, objects, and attribute structures
• Supporting Conditional Access, SSPR, MFA, and passwordless authentication (e.g. Windows Hello for Business, FIDO2)
• Identity governance activities including Access reviews, Entitlement Management and access control models.
• MS and 3rd party Agentic AI agents governance and lifecycle management.
• Engineering experience in Active Directory:
• User and group management, OU structures, Group Policy Objects (GPOs)
• Basic LDAP knowledge
• Understanding of Hybrid identity integration (Azure AD Connect / Cloud Sync)
• Awareness of AD tiering concepts and disaster recovery principles.
• Experience working with Identity Governance tooling such as Saviynt / SailPoint or any other similar product.
• Ability to define AI or identity‑analytics use cases, particularly in areas such as identity governance, lifecycle management, and access risk reduction.
• Awareness of the identity threat landscape and an understanding of how analytics or AI techniques can help detect and reduce identity‑based risks.
• Ability to work with the Engineering Manager, Product Manager, Stakeholders and senior engineers to deliver technical tasks and milestones aligned to agreed IAM roadmaps.
• Proven ability to work collaboratively with IT teams, product teams, security operations, and service partners to support secure IAM delivery and protect colleague and customer data.
• Exhibit excellent communication and presentation skills, able to convey complex issues and findings clearly and effectively.
• Demonstrates a strong technical and delivery focussed mindset, able to follow designs, apply sound engineering practices, and contribute to secure, scalable IAM solutions.
• Shows a commitment to continuous learning, staying current with identity, security, and AI developments, and applying new knowledge to improve IAM services.

Additional Criteria

• Understanding of AI and machine learning concepts to analyse identity‑related data (e.g. sign‑in logs, access patterns, usage trends).
• Awareness of AI‑assisted automation use cases within IAM:
• Access or sign‑in anomaly detection
• Risk‑based access decisions
• Intelligent access reviews or entitlement recommendations.
• Experience or familiarity with Microsoft security and analytics tools (e.g. Entra ID logs, Azure Monitor, Log Analytics, Sentinel).
• Awareness of ethical AI and responsible use of AI, especially in security‑sensitive and personal‑data contexts.
• Exposure to Privileged Access Management (PAM) solutions and role‑based privileged access (hands‑on experience beneficial but not essential).
• Understanding data governance, data quality, and information security principles, particularly where AI models consume identity data.
• Relevant professional certifications (or actively working towards), such as:
• Microsoft Identity or Security certifications
• AI / data analytics certifications
• CISSP, CISM, or equivalent (desirable).

We are committed to being a truly inclusive retailer, so you’ll be welcomed however you are and wherever you work. When you join our team, we’ll also offer you an amazing range of benefits. Here are some of them:

• Starting off with colleague discount, you'll be able to get 10% off at Sainsbury's, Argos, TU and Habitat after 4 weeks. This increases to 15% off at Sainsbury’s every Friday and Saturday and 15% off at Argos every pay day.
• We've also got you covered for your future with our pensions scheme and life cover.
• You'll also be able to share in our success as you may be eligible for a performance‑related bonus of up to 10% of salary, depending on how we perform.
• Your wellbeing is important to us too. You'll receive an annual holiday allowance, and you can buy additional holiday.
• We also offer other benefits that will help your money go further such as season ticket loans, cycle to work scheme, health cash plans, pay advance (where you can access some of your pay before pay day) as well as access to a great range of discounts from hundreds of other retailers.
• And if you ever need it there is also an employee assistance programme.
• Moments that matter are as important to us as they are to you which is why we give up to 26 weeks’ pay for maternity or adoption leave and up to 4 weeks’ pay for paternity leave.

Please see www.sainsburys.jobs for a range of our benefits (note, length of service and eligibility criteria may apply).