Senior Identity & Access Management Engineer

The Life Time Technology team is at the forefront of the evolution of Life Time into a digital-first company, transforming existing experiences and creating brand new ones both online and in our clubs. If you enjoy a fast-paced environment with the latest technologies and have a passion for health and fitness – we should meet. Work is a team effort, and we are a highly motivated, highly collaborative team; we always win or lose together. We invest in our team members and ensure they have the tools and opportunities to learn, grow and thrive. We offer an incredible benefits package, generous club discounts, and a fully subsidized Signature Life Time Membership. Want to Love Your Life? Join our team.

Position Summary We are seeking a skilled Identity & Access Management (IAM) Engineer to join our Information Technology Team. In this role, you will be responsible for designing, implementing, and maintaining enterprise identity and access management solutions that protect our organization's critical resources while enabling seamless user experiences.

You will work across a modern IAM stack including cloud identity platforms, privileged access management, directory services, and email security with PingOne, PingOne DaVinci, SailPoint Identity Cloud, CyberArk Privilege Cloud, Microsoft Active Directory, Exchange On-Premises, Mimecast, Microsoft 365, and OAuth 2.0 On-Behalf-Of (OBO) token flows for API-to-API authentication. - partnering closely with IT, Security, and Business stakeholders to ensure robust, scalable, and compliant access controls.

Job Duties and Responsibilities Identity Platform Administration (SailPoint / PingOne)

• Design, configure, and maintain PingOne identity platform including SSO, MFA, and user lifecycle management
• Build and manage identity orchestration workflows using PingOne DaVinci, including policy-driven authentication flows and integration connectors
• Integrate applications via SAML 2.0, OIDC, and OAuth 2.0 with PingOne as the Identity Provider (IdP).
• Administer and extend SailPoint Identity Cloud for identity governance, access certifications, role management, and automated provisioning/deprovisioning
• Define and enforce access governance policies, separation of duties (SoD) rules, and recertification campaigns across enterprise applications.
• Develop connectors, workflows, rules, and reports within SailPoint to meet compliance and audit requirements (SOX, HIPAA, PCI.).
• Maintain identity data integrity across connected systems and authoritative sources

Privileged Access Management (CyberArk Privilege Cloud)

• Administer CyberArk Privilege Cloud to manage, monitor, and audit privileged account access
• Onboard privileged accounts (Windows, Linux, network devices, databases, cloud service accounts) and enforce least privilege principles
• Develop and maintain CyberArk platform policies, master policies, and credential rotation schedules.
• Respond to PAM-related incidents and conduct periodic privileged access reviews
• Integrate CyberArk with enterprise systems and automate credential rotation workflows

Directory Services and Active Directory

• Manage and maintain Microsoft Active Directory infrastructure including forests, domains, OUs, GPOs, and trusts
• Support AD health monitoring, replication, and performance tuning
• Maintain and optimize Group Policy Objects (GPOs) for security hardening and compliance
• Execute AD lifecycle management: user and group provisioning, access reviews, and cleanup

Email and Messaging Security (Exchange On-Premise / Mimecast)

• Administer Microsoft Exchange On-Premises environments including mailbox management, transport rules, and connectors
• Manage Mimecast email security including policy configuration, threat protection, and continuity services
• Oversee Microsoft 365 messaging services including Exchange Online, Teams, and related workloads
• Respond to email security incidents including phishing, spoofing, and mail flow issues

Microsoft 365 and Cloud Identity

• Administer Microsoft 365 tenant including licensing, conditional access, and security baselines
• Configure and maintain Azure AD / Entra ID integration with on-premises AD via hybrid join and sync
• Implement and manage M365 security features including MFA enforcement, Privileged Identity Management (PIM), and compliance policies
• Collaborate on M365 governance, data loss prevention (DLP), and access control policies

API Authentication & OAuth 2.0 On-Behalf-Of (OBO) Flows

• Administer Microsoft 365 tenant including licensing, conditional access, and security baselines
• Design and implement API-to-API authentication patterns using the OAuth 2.0 On-Behalf-Of (OBO) token flow - enabling services to call downstream APIs on behalf of authenticated users.
• Register and manage app registrations, service principals, API permissions, and consent frameworks in Microsoft Entra ID and PingOne.
• Collaborate with development teams to review token scopes, audience validation, token lifetime policies, and secure token storage practices.
• Implement and enforce token validation, refresh token rotation, and mTLS certificate-bound token strategies where applicable.
• Document OBO flow architectures and provide guidance on secure service mesh and microservices identity patterns.

Security, Compliance and Governance

• Conduct periodic access certification campaigns and remediate inappropriate entitlements
• Ensure IAM solutions comply with regulatory frameworks such as SOX, HIPAA, NIST, and ISO 27001
• Document IAM processes, runbooks, and architecture decisions
• Participate in security audits and support evidence collection for access-related controls
• Proactively identify and remediate identity-related risks and vulnerabilities

Integration and Automation

• Develop and maintain integrations between IAM platforms using REST APIs, SCIM, LDAP, and SAML
• Build automation scripts (PowerShell, Python, or similar) to streamline IAM operations
• Collaborate with application teams to onboard new applications to SSO and provisioning workflows

Position Requirements

• 7+ years of experience in Identity & Access Management or related Information Security roles
• Hands-on experience with PingOne and/or PingOne DaVinci (or comparable CIAM/IDP platform)
• Demonstrated experience with SailPoint IIQ or IdentityNow (governance, provisioning, certifications)
• Practical knowledge of CyberArk Privilege Cloud or CyberArk PAM On-Premises
• Strong proficiency in Microsoft Active Directory administration (forests, GPOs, trusts, replication)
• Experience administering Microsoft Exchange On-Premises (2016/2019)
• Working knowledge of Mimecast administration and policy configuration
• Experience managing Microsoft 365 tenant administration and security features
• Solid understanding of IAM protocols and standards: SAML, OAuth 2.0, OIDC, SCIM, LDAP
• Proficiency in PowerShell scripting for automation and administration
• Familiarity with identity governance concepts: RBAC, SoD, least privilege, access certifications

Preferred Qualifications

• Relevant certifications such as:
• Ping Identity Certified Professional
• SailPoint Certified Identity Cloud
• CyberArk
• Microsoft Certified: Identity and Access Administrator Associate (SC-300)
• CISSP, CISM, or CompTIA Security+
• Experience with Azure AD / Microsoft Entra ID in hybrid identity environments
• Exposure to Privileged Identity Management (PIM) and Just-in-Time (JIT) access models
• Familiarity with Zero Trust architecture principles
• Experience with ITSM platforms (ServiceNow, Jira) for access request workflows
• Knowledge of Python or another scripting language for IAM automation
• Prior experience with identity audit support and SOX / PCI / HIPAA compliance

Pay This is a salaried position starting at $118,000.00(or applicable minimum salary, if higher) and pays up to $163,000.00, based on experience and qualifications.

Benefits

All team members receive the following benefits while working for Life Time:

• A fully subsidized membership
• Discounts on Life Time products and services
• 401(k) retirement savings plan with company discretionary match (21 years of age and older)
• Training and professional development
• Paid sick leave where required by law

Full-time Team Members are eligible for additional benefits, including:

• Medical, dental, vision, and prescription drug coverage
• Short term and long term disability insurance
• Life insurance
• Pre-tax flexible spending and dependent care plans
• Parental leave and adoption assistance
• Paid time off, including 5 to 20 vacation days per calendar year (based on tenure) and paid sick leave
• Deferred compensation plan, if the team member meets the required income threshold

Life Time is a place for everyone. As an organization, we are committed to an inclusive, diverse and equitable workplace that respects and celebrates the unique contributions of each individual while ensuring we remain an equal opportunity employer that recruits, hires, trains and promotes based on merit and qualifications.