IAM Secure Access Engineer at EY · Wrocław

IAM Secure Access Engineer

Location: Katowice / Wroclaw - 2 days in office / 3 days remote

Let us introduce you the job offer by EY GDS Poland – a member of the global integrated service delivery center network by EY.

Today’s world is fueled by vast amounts of information. Data is more valuable than ever before. Protecting data and information systems is central to doing business, and everyone in EY Information Security has a critical role to play. Join a global team of professionals who collaborate to support the business by protecting information assets. Our Information Security professionals enable the organization to work securely and deliver secure products and services, as well as detect and respond to security events as they happen.

Within Information Security, we blend risk strategy, digital identity, cyber defense, application security and technology solutions across the security lifecycle. You will join a team of security-focused professionals dedicated to supporting, protecting and enabling the business through innovative and secure solutions that provide business value.

The opportunity

As part of the Identity and Access Management organization, the IAM Secure Access Engineer will design, configure, test and implement authentication, federation and authorization capabilities across enterprise, cloud and hybrid environments.

The role combines traditional IAM engineering fundamentals with delivery of new Secure Access initiatives across Microsoft Entra ID, Conditional Access, PingID, PingFederate, PingAccess, Okta, PlainID, multifactor authentication, passwordless authentication, workload identities, token protection and secrets or certificate-based authentication.

The engineer will work with Architecture, Product, Operations, application teams and vendors to translate requirements into secure, supportable solutions and move changes through design, build, test, production deployment and operational handover.

Your key responsibilities

Authentication, Federation & Access Engineering:

• Design, configure and support authentication and federation integrations using SAML 2.0, OAuth 2.0, OpenID Connect and related standards.
• Implement and maintain MFA, single sign-on, passwordless authentication and risk-based access controls.
• Configure and troubleshoot PingID, PingFederate, PingAccess, Okta and Microsoft Entra ID integrations.
• Support onboarding and migration of applications to modern authentication patterns.
• Analyze authentication failures, policy conflicts, token issues and user access problems across integrated platforms.

Conditional Access & Identity Protection:

• Implement and enhance Microsoft Entra Conditional Access policies, authentication strengths, authentication contexts and protected actions.
• Support Continuous Access Evaluation, token protection, sign-in risk controls and secure administrative access patterns.
• Assess policy impact, exclusions, break-glass requirements and deployment risks before production release.
• Use logs and platform telemetry to validate control effectiveness and investigate access issues.

Authorization, Workload Identity & Secrets:

• Implement policy-based authorization using PlainID or comparable authorization platforms.
• Support role-based, attribute-based and policy-based access control patterns.
• Improve security for service principals, managed identities, application identities and other non-human identities.
• Support migration from shared secrets to managed identity, certificates or approved vault-based patterns.
• Coordinate certificate, key and secret lifecycle activities with PKI, vault and application teams.

Engineering Delivery & Operations:

• Create technical designs, implementation plans, test cases, rollback plans and operational documentation.
• Raise and manage Change Requests and support production deployments through established controls.
• Automate repeatable administration and validation tasks using PowerShell, REST APIs or other approved scripting methods.
• Perform unit, integration, regression and security testing and support post-deployment validation.
• Participate in incident, problem, vulnerability remediation and continual improvement activities.

Skills and attributes for success

• Solid understanding of authentication, authorization, identity federation, MFA, SSO and Zero Trust principles.
• Hands-on experience with at least two of the following: Microsoft Entra ID, PingID, PingFederate, PingAccess, Okta or PlainID.
• Working knowledge of SAML, OAuth 2.0, OpenID Connect, JWT, SCIM, LDAP, Kerberos and RADIUS.
• Experience with Conditional Access, Identity Protection, workload identities or modern authentication controls.
• PowerShell or comparable scripting experience and the ability to work with REST APIs, JSON and certificates.
• Strong troubleshooting, documentation, testing and stakeholder communication skills.
• Understanding of secure software delivery, ITSM, Change Management and production support practices.

To qualify for the role you must have

• Degree in Computer Science, Information Technology, Cybersecurity or a related discipline, or equivalent practical experience.
• 3 to 5 years of experience in IAM, authentication engineering, access management, security engineering or enterprise platform support.
• Familiarity with CI/CD tools such as Azure DevOps, GitHub Actions, Jenkins, or GitLab CI/CD.
• Experience creating deployment pipelines and release automation.
• Basic containerization knowledge (Docker/Kubernetes preferred).
• Experience configuring or supporting enterprise authentication and access management solutions.
• Experience delivering controlled changes across development, test and production environments.
• Ability to analyze technical issues, document findings and work effectively with distributed teams.

Ideally, you’ll also have

• Experience with Microsoft Entra Conditional Access, Ping Identity products, Okta or PlainID.
• Knowledge of passwordless authentication, FIDO2, certificate-based authentication and PKI.
• Experience with CyberArk, Azure Key Vault or another enterprise secrets platform.
• Cloud platform knowledge in Azure and familiarity with CI/CD or infrastructure automation.
• Relevant Microsoft, Ping Identity, Okta, security or ITIL certification.

What we look for

We look for a hands-on engineer who combines sound IAM fundamentals with curiosity about emerging authentication and authorization controls. The successful candidate is structured, security-minded and comfortable collaborating across application, infrastructure, architecture and operations teams.

What we offer

EY Global Delivery Services (GDS) is a dynamic and truly global delivery network. We work across nine locations – Argentina, Hungary, India, the Philippines, Poland, Sri Lanka, Mexico, Spain and the United Kingdom – and with teams from all EY service lines, geographies and sectors, playing a vital role in the delivery of the EY growth strategy. From accountants to coders to advisory consultants, we offer a wide variety of fulfilling career opportunities that span all business disciplines. In GDS, you will collaborate with EY teams on exciting projects and work with well-known brands from across the globe. We’ll introduce you to an ever-expanding ecosystem of people, learning, skills and insights that will stay with you throughout your career.

• Continuous learning: You’ll develop the mindset and skills to navigate whatever comes next.
• Success as defined by you: We’ll provide the tools and flexibility, so you can make a meaningful impact, your way.
• Transformative leadership: We’ll give you the insights, coaching and confidence to be the leader the world needs.
• Diverse and inclusive culture: You’ll be embraced for who you are and empowered to use your voice to help others find theirs.

About EY

EY | Building a better working world

EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets.

Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate.

Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today.

If you can demonstrate that you meet the criteria above, please contact us as soon as possible.

The exceptional EY experience. It’s yours to build.

In compliance with the requirements of the Whistleblower Protection Act, our company has established the Procedure for reporting breaches of law and undertaking appropriate follow-up actions. Any misconduct should be reported through the EY Ethics Hotline.