IAM Engineer I, II, III, or Senior in City of Westminster

The IAM Engineer is responsible for engineering, operating, and continuously improving Tri‑State’s identity and access management (IAM) capabilities so that the right people and systems have the right access to the right resources, at the right time, for only as long as needed. The position supports the full identity lifecycle (joiner, mover, and leaver) for employees, contractors, and non‑human identities such as service accounts across on‑premises and cloud environments. Core capabilities include directory services, identity governance and administration (IGA) and access certification, single sign‑on (SSO), multifactor authentication (MFA) and conditional access, privileged access management (PAM) including just‑in‑time (JIT) elevation, and public key infrastructure (PKI) and certificate services. The IAM Engineer partners with Human Resources, application owners, infrastructure, cybersecurity, and compliance teams to enforce least privilege, automate identity processes, support regulatory and audit requirements, and deliver secure, reliable access to Tri‑State’s business and operational systems.

At the Senior level, the incumbent is a force multiplier whose impact extends beyond their own deliverables: owns the most complex, cross‑functional, and highest‑risk IAM work; defines IAM architecture, standards, and patterns where none exist; and actively mentors and develops IAM Engineers I through III. Those with less experience will be hired at the IAM Engineer I, II, or III grade level as appropriate.

Tri‑State recognizes the value of a highly‑engaged and committed workforce and provides an excellent benefits program that includes:

• Medical Insurance
• Dental Insurance
• Vision Insurance
• Health Savings Account (HSA)
• Flexible Spending Accounts (FSA)
• Tuition Reimbursement
• Flexible Work Schedules including compressed work week and telecommuting opportunities to work remotely up to 40%
• Life Insurance
• 401K
• Long Term Disability (LTD)
• Short Term Disability (STD)
• Employee Assistant Program (EAP) and Paid Leave Benefits

Responsibilities:

• Own the most complex, cross‑functional, and highest‑risk IAM work end-to-end, defining the approach where one does not yet exist.
• Remain hands‑on in engineering, configuring, and troubleshooting IAM platforms, particularly for complex or high‑risk changes.
• Define and maintain IAM architecture, technical standards, design patterns, and runbooks across directory services, identity governance and administration (IGA), single sign‑on (SSO), multifactor authentication (MFA), privileged access management (PAM), and public key infrastructure (PKI).
• Develop and drive the IAM technical roadmap in partnership with the Cybersecurity Risk Manager, including platform modernization, identity source consolidation, and automation of identity lifecycle processes.
• Define Tri‑State’s privileged access strategy, including just‑in‑time elevation, separation of administrative accounts, and elimination of standing privilege.
• Define security role architecture and access governance standards for enterprise SaaS and ERP applications (e.g., Oracle Cloud), including role design, segregation of duties, and controls over privileged, support, and impersonation access.
• Lead the design of enterprise identity architecture, including hybrid on‑premises and cloud identity, authoritative identity sources, and integration patterns for business and operational systems.
• Define Active Directory and hybrid identity security architecture, including administrative tiering and domain controller and Group Policy security baselines, and role‑based access models for cloud platforms (e.g., Microsoft Azure, Oracle Cloud Infrastructure).
• Serve as the senior technical authority and final escalation point for IAM issues, and lead the technical response to identity‑related incidents.
• Set the bar for and review the technical quality of IAM configurations, scripts, integrations, and documentation produced by the team.
• Actively mentor and develop IAM Engineers I through III through coaching, design and code reviews, cross‑training, and stretch assignments.
• Evaluate IAM products and vendors; define requirements and lead technical evaluations, proofs of concept, and RFP reviews; and provide technical input on vendor statements of work.
• Assess IAM‑related risks and control gaps, recommend and drive remediation, and present findings and solutions to IT leadership.
• Lead IAM’s technical role in internal and external audits and regulatory compliance activities, designing controls that are sustainable and auditable.
• Partner with application owners, Human Resources, infrastructure, operational technology, and business leaders to define access requirements and IAM service boundaries, and independently lead working sessions with senior leadership.
• Identify gaps in IAM processes, tooling, and capabilities and drive improvements that make IAM services more automated, reliable, and scalable.
• Ensure IAM disaster recovery, redundancy, and resilience plans are designed, tested, and maintained.
• Maintain compliance with all company policies and procedures and attain knowledge and remain knowledgeable of regulations, laws, standards, and best practices applicable to functional area.
• Because Tri‑State has an obligation to provide continuous, reliable electric service to its customers, the ability to work overtime at any time of the day or week is considered an essential function of the job.

Qualifications:

• Bachelor’s degree in cybersecurity, computer science, information technology, information security, information assurance, or a related field, or equivalent work experience.
• Eight (8) or more years of experience in identity and access management engineering or a related field for IAM Engineer Senior.
• Expert‑level experience designing, implementing, and operating enterprise IAM solutions across identity governance and administration (IGA), directory services, SSO/federation, MFA and conditional access, privileged access management (PAM), and PKI/certificate services.
• Demonstrated experience defining IAM architecture, technical standards, and multi‑year roadmaps.
• Expert knowledge of hybrid identity architectures and identity protocols and standards (e.g., SAML, OAuth 2.0, OpenID Connect, SCIM, Kerberos, LDAP).
• Experience leading complex, cross‑functional IAM projects and vendor engagements from requirements through implementation.
• Demonstrated experience mentoring and developing other engineers.
• Experience designing controls and leading IAM’s role in audits and regulatory compliance in a regulated environment.
• Advanced proficiency in scripting, automation, and API integration (e.g., PowerShell, Python, REST APIs).
• Strong written and verbal communication skills, including presenting risks and recommendations to IT leadership.
• Experience working in fast paced environments and ability to manage workload even during times of stress or escalated activity.
• Those with less experience will be hired at the IAM Engineer I, II, or III grade level as appropriate.

Other:

• Willingness to travel as needed (approximately 15% of the time).
• Must possess a valid driver’s license.
• Willingness to work on‑call duty as assigned.
• Must successfully complete and maintain a NERC CIP personnel risk assessment (background check) and required NERC CIP training prior to being granted access to NERC CIP‑protected systems and information.

Desired Job Qualifications:

• One or more industry certifications preferred: Certified Information Systems Security Professional (CISSP), Certified Identity and Access Manager (CIAM) or Certified Identity Management Professional (CIMP), Microsoft Certified: Identity and Access Administrator Associate (SC-300), SailPoint IdentityIQ certification.
• Experience with SailPoint IdentityIQ or another enterprise identity governance and administration (IGA) platform.
• Experience with Microsoft Entra ID (including conditional access) in a hybrid Active Directory environment.
• Experience with Oracle Cloud (Fusion) security, Oracle Cloud Infrastructure (OCI) IAM, or Oracle identity integrations.
• Experience with Delinea Secret Server or another privileged access management (PAM) solution.
• Experience with Microsoft Entra Privileged Identity Management (PIM) or other just‑in‑time privileged access solutions.
• Experience with certificate lifecycle management (CLM) platforms and certificate automation (e.g., ACME, SCEP/NDES, EST), Microsoft Active Directory Certificate Services, and hardware security modules (HSMs).
• Experience using AI‑assisted tools to automate IAM engineering, scripting, and documentation in accordance with company security and data protection guidelines, and familiarity with securing access for AI applications and agents.
• Experience in Sarbanes‑Oxley (SOX) and North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) compliance.
• Experience working within a utility or energy sector.
• An MS, MBA, or related advanced degree desired.

About Us:

Tri‑State is a wholesale power supply cooperative, operating on a not‑for‑profit basis, with electric distribution cooperatives and public power district members in four states: Colorado, Nebraska, New Mexico and Wyoming. Together with its members, Tri‑State delivers reliable, affordable and responsible power and energy services to nearly a million electricity consumers across roughly 200,000 square miles of the West. Founded in 1952 by its member systems to provide a reliable, cost‑based supply of electricity, Tri‑State is now headquartered in Westminster, Colo., employing approximately 1,000 people across five states. Tri‑State's electricity is generated from coal, natural gas, hydropower, wind, and solar. This power reaches members via a transmission system that includes substation facilities, telecommunications sites and almost 6,000 miles of high voltage transmission lines. As a member‑owned and‑governed cooperative, every member has a voice and an equal vote in the future of Tri‑State.