Identity & Access Management (IAM) Subject Matter Expert

We need to output HTML fragment with sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. Must not repeat job title. Must not include Job ID etc. Must remove boilerplate, navigation, legal, EEO, etc. Must preserve all substantive info. Must not invent or summarize away detail. Must not create sections with filler like "commensurate with experience". Must only include sections when posting has real specific content. We need to parse the posting. Let's extract sections: - About the role: The first paragraph: "Be part of a team that unleashes the power of leading-edge technologies to help improve the health and well-being of those most vulnerable in our country and communities. Working at Gainwell carries its rewards. You’ll have an incredible opportunity to grow your career in a company that values work flexibility, learning, and career development. You’ll add to your technical credentials and certifications while enjoying a generous, flexible vacation policy and educational assistance. We also have comprehensive leadership and technical development academies to help build your skills and capabilities." That's about the role/company. Could be "About the role". We'll include. - Your role in our mission: Then a list of responsibilities: "Enforce the IAM strategy, architecture, and roadmap, aligning access controls with business needs, risk appetite, and regulatory obligations. Identity lifecycle and governance: Review and advise drive joiner-mover-leaver (JML) automation, account provisioning and de-provisioning, access certification campaigns, and segregation-of-duties (SoD) reviews. Access control design: Review and advise design and review role-based (RBAC) and attribute-based (ABAC) access models, least-privilege policies, and just-in-time (JIT) elevation across applications and infrastructure. Authentication and federation: Review and advise architecture and operational SSO, SAML/OIDC/SCIM integrations, federation trusts, MFA policies, and conditional access rules. Privileged access management (PAM): Review and advise on implementation and run vaulting, session management, credential rotation, and privileged session monitoring. Directory services: Review and advise on administer and secure Active Directory, Microsoft Entra ID (Azure AD), and LDAP directories, including synchronization and trust hygiene. Cloud IAM: Review and advise with enforcement of least privilege on AWS, Azure, roles, policies, service accounts, workload identity, and secret management. Compliance and audit: Review and advise on mapped identity controls to SOC 2, NIST, HIPPA, CMS and other frameworks; Review and advise with preparation of evidence; respond to audit requests and remediate findings. Automation and integration: Review and advise on build and maintain identity automation (PowerShell, Python, APIs), SCIM-based provisioning, and HR-as-source-of-truth integrations. Operations and enablement: act as subject matter expect for document standards and runbooks, deliver training, and mentor team members. Vendor and tooling evaluation: Review and advise on assessing and manage identity platforms (IGA, PAM, IdP, IDB and CIAM). Project delivery: plan, scope, and lead IAM projects and migrations end-to-end, timelines, dependencies, stakeholder coordination, risk tracking, and rollout, from discovery through hypercare." That's responsibilities. We'll put under

Responsibilities

with

• each bullet. - Required: "What we're looking for 10 + years in IT / information security, with 7 + years of hands-on IAM experienceExpert-level working knowledge of IAM protocols (SAML, OAuth 2.0 / OIDC, SCIM, LDAP, Kerberos)Deep hands-on experience with Active Directory and Microsoft Entra ID (Azure AD)Proven experience running IGA programs (access certifications, SoD) and/or PAM implementationsExperience enforcing least privilege across cloud environments (AWS, Azure)Strong automation capability (PowerShell or Python) and API integration experienceExperience supporting audits and mapping identity controls to frameworks such as SOC 2, SOC 2, NIST, HIPPA, CMSProject management experience: leading IAM initiatives (migrations, IGA/PAM rollouts, SSO deployments) from planning through delivery, with clear timelines, dependencies, and stakeholder communicationDegree in a relevant field, or equivalent demonstrable experience" That's requirements/qualifications. Could split into Requirements and Qualifications? The instruction says use headings for sections like Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to decide what content goes where. We have required experience, knowledge, etc. Could treat as Requirements. Preferred & Certifications: "CISSP, CISM, or equivalent security certificationMicrosoft Certified: Identity and Access Administrator Associate (SC-300)Vendor certifications: Okta, SailPoint, Saviynt, CyberArk, or equivalentCloud certifications (AWS, Azure) and zero trust architecture exposureExperience with HRIS-to-directory integration and identity automation at scale" That could be Qualifications or Skills. We'll put under Qualifications. Skills: maybe list specific technical skills: IAM protocols, AD, Azure AD, IGA, PAM, cloud least privilege, automation PowerShell/Python, API integration, audit frameworks, project management. Could be separate Skills section. But we must not create sections with filler. We have content for each. Benefits: The posting mentions: "You’ll add to your technical credentials and certifications while enjoying a generous, flexible vacation policy and educational assistance. We also have comprehensive leadership and technical development academies to help build your skills and capabilities." Later: "All salaried, full-time candidates are eligible for our generous, flexible vacation policy, a 401(k) employer match, comprehensive health benefits, and educational assistance. We also have a variety of leadership and technical development academies to help build your skills and capabilities." Thus benefits: generous flexible vacation policy, educational assistance, 401(k) employer match, comprehensive health benefits, leadership and technical development academies. Pay: "The pay range for this position is $95,100.00 - $135,800.00 per year, however, the base pay offered may vary depending on geographic region, internal equity, job-related knowledge, skills, and experience among other factors." Schedule: There's mention: "Remote-based opportunity within the United StatesOpportunities to travel through your work (0-10%)Video cameras must be used during all interviews, as well as during the initial week of orientationThe deadline to submit applications for this posting is 10/30/2026" Schedule maybe not explicit; remote-based, travel 0-10%. Could be considered Schedule? The instruction says include Schedule section only if posting actually states them. It does mention remote-based and travel. That's about work arrangement, not schedule hours. Might be considered Schedule? Could treat as "Schedule" but it's not hours. Might be better to not create Schedule section because no explicit schedule like full-time, part-time, shift. However remote-based and travel could be considered under "About the role" or maybe a separate "Work Arrangement". But we only allowed headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Since we have remote and travel info, we could put under Schedule? But schedule usually refers to hours, not location. However the instruction says include Schedule section only when posting actually states them. It does state remote-based opportunity and travel 0-10%. That's about work arrangement, could be considered schedule? Might be okay to include Schedule with that info. But we must avoid filler like "not specified". We have specifics. Thus we will create sections: - About the role: intro paragraph. - Responsibilities: list of duties. - Requirements: required experience (10+ years IT/infosec, 7+ IAM, etc). Could be a list. - Qualifications: preferred & certifications (CISSP, etc) plus maybe degree? Actually degree is in required. We'll keep degree in Requirements. - Skills: maybe list specific technical skills: IAM protocols, AD/Azure AD, IGA/PAM, cloud least privilege, automation (PowerShell/Python), API integration, audit frameworks, project management. Could be derived from required. - Benefits: generous flexible vacation policy, educational assistance, 401(k) employer match, comprehensive health benefits, leadership and technical development academies. - Pay: pay range. - Schedule: remote-based within US, travel 0-10%, video camera requirement for interviews and orientation, application deadline 10/30/2026. We must not include boilerplate like EEO, legal, etc. Must not include navigation, cookie, etc. Must not repeat job title. Must not include Job ID. We must preserve all substantive information. Ensure we don't lose any detail. Let's extract each piece precisely. About the role paragraph: "Be part of a team that unleashes the power of leading-edge technologies to help improve the health and well-being of those most vulnerable in our country and communities. Working at Gainwell carries its rewards. You’ll have an incredible opportunity to grow your career in a company that values work flexibility, learning, and career development. You’ll add to your technical credentials and certifications while enjoying a generous, flexible vacation policy and educational assistance. We also have comprehensive leadership and technical development academies to help build your skills and capabilities." That's it. Responsibilities: We need to break into bullet points. The text includes many sentences separated by periods. We'll create each as a bullet. Let's list: - Enforce the IAM strategy, architecture, and roadmap, aligning access controls with business needs, risk appetite, and regulatory obligations. - Identity lifecycle and governance: Review and advise drive joiner-mover-leaver (JML) automation, account provisioning and de-provisioning, access certification campaigns, and segregation-of-duties (SoD) reviews. - Access control design: Review and advise design and review role-based (RBAC) and attribute-based (ABAC) access models, least-privilege policies, and just-in-time (JIT) elevation across applications and infrastructure. - Authentication and federation: Review and advise architecture and operational SSO, SAML/OIDC/SCIM integrations, federation trusts, MFA policies, and conditional access rules. - Privileged access management (PAM): Review and advise on implementation and run vaulting, session management, credential rotation, and privileged session monitoring. - Directory services: Review and advise on administer and secure Active Directory, Microsoft Entra ID (Azure AD), and LDAP directories, including synchronization and trust hygiene. - Cloud IAM: Review and advise with enforcement of least privilege on AWS, Azure, roles, policies, service accounts, workload identity, and secret management. - Compliance and audit: Review and advise on mapped identity controls to SOC 2, NIST, HIPPA, CMS and other frameworks; Review and advise with preparation of evidence; respond to audit requests and remediate findings. - Automation and integration: Review and advise on build and maintain identity automation (PowerShell, Python, APIs), SCIM-based provisioning, and HR-as-source-of-truth integrations. - Operations and enablement: act as subject matter expect for document standards and runbooks, deliver training, and mentor team members. - Vendor and tooling evaluation: Review and advise on assessing and manage identity platforms (IGA, PAM, IdP, IDB and CIAM). - Project delivery: plan, scope, and lead IAM projects and migrations end-to-end, timelines, dependencies, stakeholder coordination, risk tracking, and rollout, from discovery through hypercare. Note: There's a typo "expect" but we keep as is. Requirements: Let's extract required bullet points. The required section text: "10 + years in IT / information security, with 7 + years of hands-on IAM experienceExpert-level working knowledge of IAM protocols (SAML, OAuth 2.0 / OIDC, SCIM, LDAP, Kerberos)Deep hands-on experience with Active Directory and Microsoft Entra ID (Azure AD)Proven experience running IGA programs (access certifications,