Identity & Access Management Engineer

About the role

Sonar, a global code quality and security platform founded in Geneva and headquartered in Austin, Texas, is looking for an experienced Identity & Access Management (IAM) Engineer. The engineer designs, builds and operates the identity platforms that secure access to applications, infrastructure and data, owning the technical direction of authentication, authorization, lifecycle management and privileged access. The role works with security, IT, engineering and compliance teams and aligns with Zero Trust principles.

Key responsibilities

• Design, implement and maintain enterprise IAM solutions, including SSO, MFA, federation and directory services.
• Architect and manage identity lifecycle processes (joiner/mover/leaver), automating provisioning and deprovisioning across SaaS, cloud and on-prem systems.
• Implement and operate Privileged Access Management (PAM), including vaulting, session management and just-in-time access.
• Lead Identity Governance and Administration (IGA) initiatives such as access reviews, certifications, RBAC and segregation-of-duties controls.
• Integrate applications with the identity platform using SAML, OIDC, OAuth 2.0, SCIM and LDAP.
• Develop automation and tooling (APIs, scripts, CI/CD pipelines, Infrastructure as Code).
• Secure cloud identity and access across AWS, Azure and/or GCP, including IAM policies, workload identity and service accounts.
• Define authentication and authorization standards and monitor identity-related threats.

Required profile

• 6 to 15 years of experience in IAM, security engineering or a related field.
• Hands-on experience with at least one major IAM platform such as Okta, Microsoft Entra ID (Azure AD), Ping Identity, ForgeRock, SailPoint or CyberArk.
• Experience with Active Directory and directory services architecture.
• Proficiency in at least one scripting or programming language (Python, PowerShell, Go, Java or JavaScript).
• Experience with MFA, passwordless and conditional or risk-based access.
• Familiarity with Zero Trust, least privilege and defense-in-depth principles.

Required skills

• SAML 2.0, OAuth 2.0, OpenID Connect, SCIM, LDAP and Kerberos.
• Solid understanding of cloud IAM models (AWS IAM, Azure RBAC, GCP IAM).
• Strong analytical, problem-solving and communication skills.

The position is based in Geneva; relocation is offered to the right candidate. Offers are contingent on a background check and reference verification, and applications through agencies are not considered.