Principal IAM Engineer

We need to output HTML fragment with sections: About the role? The posting includes "About Lantern" description, then details about role. We need to use

for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must include only sections that have real specific content. The posting includes "About Lantern" (company description) but not "About the role". However we could treat "About Lantern" as "About the role"? The instruction: use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we should map content to those headings if appropriate. The posting includes a description of the company and role. Could put that under "About the role". Also there is "Location: Hybrid - at least 3 days/wk in our Dallas, TX offices". That's schedule/location info; schedule maybe not given. There's no explicit Pay or Schedule details besides location hybrid. So we should not create Pay or Schedule sections unless posting actually states them. It does not state pay, so omit Pay. Schedule: location hybrid is not schedule; but maybe we could treat as Schedule? The instruction says only create Schedule section if posting actually states them. It does not state schedule like full-time, hours, etc. So omit Schedule. Benefits: there is a list: Medical Insurance, Dental Insurance, Vision Insurance, Short & Long Term Disability, Life Insurance, 401k with company match, Flexible Time Off, Paid Parental Leave. So we can create Benefits section with

. Responsibilities: there is a big list under "Responsibilities:" and also "Key Deliverables in Your First Year:" and "How You Will Work:" maybe combine under Responsibilities? The instruction: use
• for any list of duties/requirements/benefits. So we need to extract duties. The responsibilities list includes many bullet-like sentences. We'll create a
  with each responsibility as
  • . Also include key deliverables and how you will work? Those could be part of responsibilities as well. But to avoid duplication, we can include them as responsibilities. Requirements: there is a "Requirements:" section with bullet-like list. Also "Strong Candidates Will:" and "Who Thrives in This Role:" maybe considered Qualifications or Skills. We need to decide sections: Requirements, Qualifications, Skills. The posting includes "Requirements:" list, then "Strong Candidates Will:" list, then "Who Thrives in This Role:" list (traits). Also "About You:" list (values). We could map: Requirements = the eight+ years etc. Qualifications = Strong Candidates Will? Skills = Who Thrives? Or maybe treat Strong Candidates Will as Qualifications, Who Thrives as Skills, About You as maybe not needed. But we should not create sections with filler. We have substantive content for each. We must not repeat job title as heading. No Job ID. We must remove boilerplate like EEO etc. At end there is EEO statement; we should drop. Also remove navigation, cookie, legal, duplicated lines, application instructions (the "Please apply..."). We need to preserve all substantive information. Let's extract content. Company description: "About Lantern Lantern is the specialty care platform connecting people with the best care when they need it most. By curating a Network of Excellence comprised of the nation's top specialists for surgery, cancer care, infusions and more, Lantern delivers excellent care with significant cost savings to employers and their workforces. Lantern also pairs members with a dedicated care team, including Care Advocates and nurses, for the entirety of their care journey, helping them get back to good health, back to their families and back to work. With convenient access to specialists nationwide, Lantern means quality care is within driving distance for most. Lantern is trusted by the nation's largest employers to deliver care to more than 6 million members across the country. Learn more about us at lanterncare.com. Lantern is the specialty care platform, connecting people with high-quality, affordable specialty care close to home. We operate in a regulated healthcare environment (HIPAA, HITRUST, SOC 2), we handle protected health information at scale, and we are becoming an AI healthcare company, with AI adoption a top company priority." That's about the company. Could be placed under "About the role"? Might be okay. Role description: "This Principal IAM Engineer is a senior level, individual-contributor role and the technical authority for identity at Lantern. In an organization where the security perimeter is effectively identity, you will own the identity control plane end to end, and you will determine who can reach PHI and under what conditions. You will set the identity standard, build the automation behind it, and hold the verification bar that other teams operate against. You will report to the CISO and partner closely with our IAM engineer and with the platform, cloud, and service delivery teams that execute alongside you. This is a hands-on principal seat, not a people-management role today, with a clear path to expand into a leadership role as the identity function grows. Our security philosophy is open by default, secure by design. Security exists to help the business move fast, safely, and the default answer is “yes, safely,” because guardrails are built into the platform, pipelines, and tooling rather than enforced by someone saying no. Gates exist only where risk genuinely warrants them, and even then they are automated, fast, and transparent. Location: Hybrid - at least 3 days/wk in our Dallas, TX offices" We could include location under maybe a separate section? Not required. Responsibilities list: - Own the identity lifecycle: joiner, mover, and leaver provisioning and deprovisioning, automated from role- and attribute-based models (RBAC/ABAC), with deprovisioning verified against an entitlement inventory rather than assumed. - Own access management, including Conditional Access, phishing-resistant MFA, and privileged access on a Zero Trust model, with least-privilege by default, just-in-time (JIT) elevation, and enforcement confirmed on every access path rather than only saved. - Own directory and federation across Entra ID, single sign-on, SAML, OIDC, and OAuth2. - Own secrets and non-human identity, including API keys, service accounts, and workload identity, and maintain an owner registry for them. - Own key access governance and separation of duties in a model where another team operates the key management system. - Own identity automation and identity-as-code, building lifecycle and access controls as reviewable, version-controlled infrastructure (Terraform and policy-as-code) rather than manual configuration. - Own the identity-verification standard the service desk follows for password resets, MFA resets, and device enrollment. This is a hands-on control point, because helpdesk-initiated resets are a leading account-takeover vector. Key Deliverables in Your First Year: - Conditional Access enforced by default on PHI-facing applications, with enforcement verified. - Automated joiner, mover, and leaver provisioning and deprovisioning that meets its SLA every time. - A secrets golden path, with vaulted secrets, none in code, and a populated key-to-owner registry. - Strong, phishing-resistant MFA coverage on privileged accounts. - Documented runbooks and depth across the control plane, so no critical control depends on a single person. How You Will Work: - You will set standards that partner teams execute. - Service Delivery performs provisioning tasks and resets against the verification bar you own. - Cloud Engineering carries cloud access, workload identity, and key-management operations, with key access governed by you. - HR events are the sole trigger for lifecycle changes. - The Governance, Risk & Compliance team independently attests to the entitlements you produce, and access certification deliberately sits outside this role so that the team reviewing access is not the team granting it. - Holding those boundaries cleanly is central to the job. We can combine all these bullet points under Responsibilities. Requirements list: - Eight or more years in identity and access management, including principal- or staff-level ownership of an identity control plane. - Deep Microsoft Entra ID engineering, including Conditional Access policy design, phishing-resistant MFA, single sign-on, and federation across SAML, OIDC, and OAuth2, and verifying that enforcement takes effect across every access path, not only the expected one. - Identity lifecycle automation across cloud, SaaS, and privileged systems, with role- and attribute-based provisioning (RBAC/ABAC) and deprovisioning verified against an entitlement inventory. - Zero Trust identity design, including least-privilege, just-in-time (JIT) access, and risk-based or adaptive access controls. - Identity governance and administration (IGA) platform engineering, including privileged access management. - Automation and scripting (PowerShell, Python, or similar) to build lifecycle workflows and custom connectors. - Identity-as-code and policy-as-code practice, using Terraform with source-controlled change management (for example, GitHub). - Secrets and non-human identity (API keys, service accounts, workload identity), and maintaining an owner registry for them. - Key access governance and separation of duties in a model where another team operates the key management system. - The ability to act as the technical authority for a function without formal people-management authority, working directly to a CISO. - Bachelor’s degree in a relevant field, or equivalent professional experience. Strong Candidates Will: - Healthcare or another regulated environment where identity controls gate access to PHI. - Hands-on Saviynt with PAM, Azure PIM, and Keeper, or transferable depth in comparable platforms. - Experience remediating a Conditional Access enforcement gap or a deprovisioning failure, and making the structural change that prevented recurrence. - Passkeys and FIDO2, or phishing-resistant authenticator experience, aligned with NIST SP 800-63 Rev. 4. - Experience growing a technical scope into a broader leadership remit. - Microsoft Identity and Access Administrator certification, CIMP, or equivalent. Who Thrives in This Role: - Verified enforcement. You do not consider a control done until you have seen it working on every path. - Automation bias. You remove the manual step rather than documenting it more carefully. - Structural fixes. You solve the class of failure, not the instance. - Boundary clarity. You hold the standard with partner teams without taking over their execution. - Governance respect. You keep access certification independent rather than absorbing it. About You: (values) maybe we could treat as Qualifications? But we already have Qualifications maybe as Strong Candidates Will. About You could be considered Skills? But it's more about personal traits. Could be placed under Skills? However we already have Who Thrives in This Role as Skills. About You could be omitted? It contains substantive info about values; we could include under Qualifications or Skills. But we must not create sections with filler. We have content for About You; we could make a section "Qualifications" for Strong Candidates Will, and "Skills" for Who Thrives, and maybe "About You" could be omitted or placed under Qualifications as well. But we need to preserve all substantive information. So we need to include About You somewhere. Could add a section "Qualifications" that includes both Strong Candidates Will and About You? Or we could add a section "Qualifications" for Strong Candidates Will, and another section "Skills" for Who Thrives, and maybe a section "About You" not in the list of allowed headings; but we could map About You to "Qualifications" as well? The allowed headings are About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we can use Qualifications and Skills. We need to fit About You into either Qualifications or Skills. Since About You describes personal attributes (logic, inclusion, grit, integrity, etc.) maybe fits Skills. Who Thrives also describes traits; both could be under Skills. But we need to avoid duplication. We could combine both lists under Skills. Thus: - Qualifications: Strong Candidates Will list. - Skills: Who Thrives in This Role list + About You list. We must ensure we don't create sections with filler. All have content.