Senior Workforce IAM Engineer

College Board – Technology – Workforce IAM Location: This is a remote role. Candidates who live near CB offices have the option of being fully remote or hybrid (Tuesday and Wednesday in office). All CB employees are required to occasionally travel to meet in person for business purposes. Role Type: This is a full-time position

About the Team The Workforce Identity and Access Management (WIAM) team is the identity control plane for College Board's enterprise. The team owns the full workforce identity lifecycle, from onboarding and provisioning through access governance, certification, and offboarding, and operates the platforms that enforce authentication, authorization, and privileged access management across the organization.

WIAM's work spans six capability pillars: identity onboarding, provisioning, authentication and authorization, credential management, governance and compliance, and identity offboarding. Each pillar has a named engineer accountable for its maturity, its roadmap, and the controls that run inside it. The team is the primary owner of College Board's enterprise IGA platform and PAM infrastructure, and it partners closely with Talent, ISGRC, and security peer teams to ensure identity services are reliable, auditable, and aligned to Zero Trust principles.

The team operates at the intersection of security rigor and user experience; the controls WIAM builds directly affect how every College Board employee accesses systems and data every day. As College Board's workforce has grown and its cloud and SaaS footprint has expanded, WIAM's scope has grown to match: centralizing more applications, automating more lifecycle actions, and governing an increasingly complex mix of human and non-human identities.

About the Opportunity As a Senior Engineer on the WIAM team, you are a hands-on identity engineer who owns the Governance and Compliance pillar and is accountable for it meeting its goals. The pillar covers the governance of access and identities in the IGA platform across human, service, and AI agent identities (currently in the building phase), including access reviews, security attestations, account reviews, least-privilege enforcement, segregation of duties, and account ownership and accountability. You ensure the access sent to reviewers is accurate and understandable, that reviews run on schedule, and that each produces clear, auditable evidence. While each review has an owner, you administer and facilitate how it is implemented, advising on feasibility, scheduling, notifications and communications, the evidence produced, and what the platform can give the reviewers. You are directly involved in how AI agents are integrated into the IGA platform, so they meet the same level of accountability through defined owners, lifecycle states, and reviewable access, while minimizing business impact when access is removed.

You also work as part of our broader WIAM team, where all engineers share the workload across our applications (AD, Entra ID, Okta OIG, CyberArk, and 1Password). That work includes access provisioning, identity management, setting up applications and integrations, building and maintaining automations (PowerShell, Okta Workflows, ADManager Plus, and other automation tools), maintaining vaults in CyberArk, and various other tasks. You bring a governance lens to all of it, asking what internal and external auditors will want from each process and making sure it is there. The controls you build shape how every College Board employee reaches the systems and data they need to serve students.

In this role, you will:

Facilitate Certifications, Attestations, and Governance (35%)

• Plan and forecast the year's review cycle in Okta, including annual recurring reviews and new work, while balancing other teams' capacity against compliance and external audit deadlines
• Design, configure, launch, monitor, and close access reviews, account reviews, and security attestations in Okta across human, service, and AI agent identities, scoped so reviewers can make considered decisions while reducing review fatigue
• Bring new account types into the recurring review cycle as they come into scope
• Run the annual user access review cycle end to end, from scoping and reviewer assignment through remediation, closure, and delivery of the auditor reporting package against the use cases agreed upon with the audit owner
• Fulfill evidence requests from internal College Board groups and external auditors by the agreed due date
• Verify requirements and review data before launch, and bring any issues you spot to the review owner
• Maintain the job guides and documentation that let another engineer run a review cycle correctly without you
• Partner with Security, Risk, Audit, Technology and business teams to translate security, compliance and technical requirements into workable identity controls
• Keep WIAM's practices aligned to College Board information security policy, tracking policy changes and flagging where team practice needs to move

Build and Enforce AI Governance (25%)

• Integrate AI agent identities into the IGA platform as they come online, with defined owners, lifecycle states, and reviewable access
• Define the ownership model for AI agents: who is accountable for an agent's access, and what happens when its purpose or owner changes
• Bring AI agent identities under access review and least-privilege enforcement on the same cycle as human and service accounts
• Govern the access AI tools and agents hold to College Board systems and data: what each can reach, who approved it, how it is reviewed, and how to revoke it
• Build and run the attestation flows for AI tools as the organization adopts them, reusing patterns rather than rebuilding per tool
• Partner with AI governance stakeholders and Risk Engineering so identity controls for agents are designed once and land in the right place

Build & Run Identity Services with Security in Mind (40%)

• Work alongside the team on day-to-day identity engineering, including onboarding, offboarding, and access requests, asking what internal and external auditors will want from each and making sure it is there
• Direct and review governance pillar work carried out by other engineers on the team, remaining accountable for the outcome
• Establish and maintain account ownership and accountability across identity types: named owners and defined lifecycle states for human, service, and workload identities, extending to API identities as they come into scope
• Enforce least privilege with exceptions documented and tracked
• Monitor and correct any unintended changes between approved and actual entitlements across centralized applications
• Automate enforcement and evidence with Okta Workflows and platform APIs
• Measure the team's controls against recognized industry frameworks such as NIST, identify gaps, and propose how to close them
• Report on the enforcement of the pillar's controls with documented, traceable data
• Analyze access and entitlement data to support troubleshooting, audits, and continuous improvement
• Participate in the team's on-call rotation, responding to identity platform incidents and following established escalation procedures

About You

To qualify for this role, you must have:

• 5+ years of identity and access management and/or security engineering experience, including hands-on work with Active Directory, Entra ID, and Okta
• Experience designing and running access reviews, certifications, or attestation campaigns at scale, including scoping, reviewer assignment, remediation, and closure, and delivering the evidence to internal or external auditors
• Working knowledge of policy and compliance frameworks such as NIST, and the judgment to translate framework guidance into practical control requirements
• Hands-on production experience with Okta, especially Okta Identity Governance and Okta Workflows
• Experience with agentic AI governance: treating agents and workload identities as governed identities with owners, lifecycle states, and certifiable access
• Solid grounding in identity and access standards (SAML, OIDC, OAuth 2.0, SCIM) and in role- and attribute-based access control, SSO, MFA, and least privilege
• A secure-by-design mindset, with security built in as a system is designed, and a habit of checking a system’s actual state rather than what the configuration screen reported and of tracing a number back to the record it came from
• Strong written communication and the ability to see a control from the business and end-user perspective as well as the engineer's, including explain a control to someone who does not work in identity
• Preferred: Experience as an IT auditor or in a GRC function, testing controls over identities, provisioning, and access
• Preferred: Enterprise security certifications or recent coursework (e.g., CISSP, CISA, CRISC, Okta certifications, or similar)
• Preferred: A working understanding of defense in depth and how to implement layered controls in practice

All roles at College Board require:

• A passion for expanding educational and career opportunities and mission-driven work
• Authorization to work in the United States for any employer
• Curiosity and enthusiasm for emerging technologies, with a willingness to experiment with and adopt new AI-driven solutions and comfort learning and applying new digital tools independently and proactively.
• Clear and concise communication skills, written and verbal
• A learner's mindset and a commitment to growth: welcoming diverse perspectives, giving and receiving timely, respectful feedback, and continuously improving through iterative learning and user input
• A drive for impact and excellence: solving complex problems, making data-informed decisions, prioritizing what matters most, and continuously improving through learning, user input, and external benchmarking
• A collaborative and empathetic approach: working across differences, fostering trust, and contributing to a culture of shared success

About Our Process

• Application review will begin immediately and will continue until the position is filled. This role is expected to accept applications for a minimum of 5 business days.
• While the hiring process may vary, it generally includes: resume and application submission, recruiter phone/video screen, hiring manager interview, performance exercise such as live coding, a panel interview, a conversation with leadership and reference checks.

What We Offer At College Board, we offer more than just a paycheck - we provide a meaningful career, a supportive team, and a comprehensive package designed to help you thrive. We’re a self-sustaining nonprofit that believes in fair and competitive compensation, grounded in your qualifications, experience, impact, and the market.

A Thoughtful Approach to Compensation

• The hiring range for this role is $153,000 – $166,000.
• Your exact salary will depend on your location, experience, and how your background compares to others in similar roles at College Board.
• We aim to make our best offer upfront - rooted in fairness, transparency, and market data.
• We adjust salaries by location to ensure fairness, no matter where you live.

You’ll have open, transparent conversations about compensation, benefits, and what it’s like to work at College Board throughout your hiring process. Check out our careers page for more.