Principal IAM Engineer

Lantern is a specialty care platform connecting people with high-quality specialty care. The Principal IAM Engineer is a senior, individual-contributor role and the technical authority for identity at Lantern. The role owns the identity control plane end to end, determines who can reach PHI and under what conditions, sets the identity standard, builds the automation behind it, and holds the verification bar that other teams operate against. The role reports to the CISO and partners with the IAM engineer and with the platform, cloud, and service delivery teams. It is a hands-on principal seat, not a people-management role today, with a clear path to expand into leadership as the identity function grows.

Responsibilities

Own the identity lifecycle, including joiner, mover, and leaver provisioning and deprovisioning automated from RBAC/ABAC models, with deprovisioning verified against an entitlement inventory; Own access management, including Conditional Access, phishing-resistant MFA, and privileged access on a Zero Trust model with least-privilege, JIT elevation, and enforcement confirmed on every access path; Own directory and federation across Entra ID, single sign-on, SAML, OIDC, and OAuth2; Own secrets and non-human identity, including API keys, service accounts, and workload identity, and maintain an owner registry; Own key access governance and separation of duties in a model where another team operates the key management system; Own identity automation and identity-as-code using Terraform and policy-as-code; Own the identity-verification standard the service desk follows for password resets, MFA resets, and device enrollment; Set standards that partner teams execute, with Service Delivery performing provisioning and resets and Cloud Engineering handling cloud access, workload identity, and key management operations; Keep access certification independent, with the Governance, Risk & Compliance team attesting to entitlements

Requirements

Eight or more years in identity and access management, including principal- or staff-level ownership of an identity control plane; Deep Microsoft Entra ID engineering, including Conditional Access policy design, phishing-resistant MFA, single sign-on, and federation across SAML, OIDC, and OAuth2, with verification that enforcement applies across every access path; Identity lifecycle automation across cloud, SaaS, and privileged systems, with RBAC/ABAC provisioning and deprovisioning verified against an entitlement inventory; Zero Trust identity design, including least-privilege, just-in-time (JIT) access, and risk-based or adaptive access controls; Identity governance and administration (IGA) platform engineering, including privileged access management; Automation and scripting (PowerShell, Python, or similar) to build lifecycle workflows and custom connectors; Identity-as-code and policy-as-code practice using Terraform with source-controlled change management (for example, GitHub); Secrets and non-human identity management (API keys, service accounts, workload identity), including maintaining an owner registry; Key access governance and separation of duties in a model where another team operates the key management system; The ability to act as technical authority for a function without formal people-management authority, working directly to a CISO; Bachelor's degree in a relevant field, or equivalent professional experience

Nice to have

Healthcare or another regulated environment where identity controls gate access to PHI; Hands-on Saviynt with PAM, Azure PIM, and Keeper, or transferable depth in comparable platforms; Experience remediating a Conditional Access enforcement gap or a deprovisioning failure, and making the structural change that prevented recurrence; Passkeys and FIDO2, or phishing-resistant authenticator experience, aligned with NIST SP 800-63 Rev. 4; Experience growing a technical scope into a broader leadership remit; Microsoft Identity and Access Administrator certification, CIMP, or equivalent

Benefits

Medical Insurance; Dental Insurance; Vision Insurance; Short & Long Term Disability; Life Insurance; 401k with company match; Flexible Time Off; Paid Parental Leave