Cloud IAM Engineer

Role Overview

The Cloud IAM Engineer (described as a Cloud IAM Operations Engineer) will manage the day-to-day identity and access provisioning across an AWS environment. This is a hands-on, execution-focused role aligned to established policies (rather than defining them), partnering with security architecture on escalations and edge cases.

Responsibilities

• Review AWS access requests against least-privilege principles and organizational access policy.
• Provision and implement approved access using Infrastructure as Code (with CDK preferred).
• Manage Just-In-Time (JIT) access so human AWS access is granted on-demand via JIT workflows (avoiding persistent permissions).
• Maintain accurate, auditable records of access grants, changes, and revocations.
• Identify and escalate access requests that are outside standard policy or carry elevated risk.
• Support access reviews and recertification processes.
• Contribute to runbooks and documentation to improve the access request lifecycle.
• Partner with security architecture and IAM leadership on process improvements and automation.
• Conduct periodic reviews of AWS IAM permission sets using IAM Access Analyzer (and other tooling) to find unused permissions and overly permissive policies and refine controls.

Requirements

• 2–4 years of experience in cloud security, IAM, or AWS cloud technologies.
• Strong working knowledge of AWS IAM fundamentals (roles, policies, permission sets, and least-privilege design).
• Experience with Infrastructure as Code (CDK preferred, Pulumi considered by implication in the text).
• Strong communication and interpersonal skills (people-facing role).

Nice to Have

• Additional familiarity with JIT access management tooling and access review/recertification operations.