IAM AI Engineer

The Identity and Access Management AI Engineer is responsible for designing, engineering, and operationalizing AI-enabled identity security capabilities across the enterprise. This role combines deep IAM engineering expertise with artificial intelligence, machine learning, automation, and analytics to strengthen identity controls, reduce access risk, improve operational efficiency, and detect emerging identity-based threats.

The engineer will help modernize identity services by applying AI to access governance, privileged access, authentication risk, identity lifecycle management, entitlement analysis, anomaly detection, and automated decision support. This includes helping deploy and operationalize the built-in AI capabilities expected in the next version of Identity Manager. This position partners closely with IAM, the Corporate AI Team, cyber defense, security architecture, infrastructure, cloud, data science, risk, compliance, and application teams to deliver secure, scalable, and compliant identity solutions.

• Design, build, and support AI-driven IAM capabilities that improve identity governance, access management, privileged access management, and authentication risk controls.
• Develop models, analytics, and automation that identify excessive access, toxic entitlement combinations, segregation of duties conflicts, dormant accounts, orphaned identities, risky privileged access, and abnormal authentication behavior.
• Apply machine learning, rules-based analytics, and graph-based identity intelligence to detect access anomalies and recommend remediation actions.
• Engineer AI-assisted workflows that support access request reviews, entitlement certification, role mining, policy recommendations, and identity lifecycle decisions.
• Partner with IAM platform owners to integrate AI capabilities into identity governance, access management, PAM, directory, and cloud identity tools.
• Lead or support deployment, configuration, governance, and adoption of built-in AI capabilities delivered in the next version of Identity Manager.

Identity Governance and Access Intelligence

• Enhance identity governance processes through automated access insights, risk scoring, peer-group analysis, and entitlement usage analytics.
• Support role-based access control, attribute-based access control, policy-based access control, and least-privilege access models using data-driven recommendations.
• Design and tune access risk models that prioritize remediation based on business criticality, privilege level, account type, data sensitivity, and user behavior.
• Improve access certification campaigns by reducing reviewer fatigue, identifying low-risk approvals, and surfacing high-risk exceptions for focused review.
• Develop reporting and dashboards that provide IAM leadership, risk teams, auditors, and application owners with actionable identity risk insights.

AI Security and Responsible AI Controls

• Embed security, privacy, and responsible AI principles into IAM AI solutions from design through production operations.
• Assess AI-enabled identity use cases for risks such as data leakage, prompt injection, model misuse, biased recommendations, excessive automation, and unauthorized access to sensitive identity data.
• Implement controls for model access, prompt governance, data minimization, audit logging, approval workflows, and human-in-the-loop decision-making.
• Collaborate with legal, privacy, compliance, and risk stakeholders to ensure IAM AI solutions align with internal policies, regulatory obligations, and industry frameworks.
• Work closely with the Corporate AI Team to ensure IAM AI solutions align with enterprise AI strategy, approved AI architecture patterns, model governance, responsible AI standards, and shared AI platform capabilities.
• Document AI decision logic, data sources, assumptions, limitations, and control requirements to support auditability and transparency.

Platform Integration and Automation

• Integrate IAM AI capabilities with enterprise platforms such as Microsoft Entra ID, SailPoint, Saviynt, Okta, Ping, CyberArk, One Identity, ServiceNow, SIEM, SOAR, cloud platforms, and data lake environments.
• Develop secure APIs, scripts, pipelines, and automation patterns that streamline identity lifecycle management, access provisioning, deprovisioning, review, and remediation.
• Use infrastructure as code, DevSecOps, and CI/CD practices to deploy reliable, repeatable, and secure IAM AI services.
• Partner with data engineering teams to ingest, normalize, protect, and analyze identity, access, authentication, privilege, HR, application, and security event data.
• Coordinate with the Corporate AI Team on AI platform integration, approved model usage, reusable AI services, monitoring practices, and enterprise AI deployment patterns.
• Ensure solutions are resilient, observable, scalable, and aligned with enterprise architecture standards.

Threat Detection and Identity Defense

• Develop and tune identity threat detection analytics for suspicious authentication, impossible travel, abnormal privilege use, anomalous service account behavior, risky API access, and unusual entitlement changes.
• Support cyber defense teams by correlating IAM telemetry with endpoint, network, cloud, application, and threat intelligence data.
• Contribute to incident response playbooks for identity compromise, credential misuse, privileged access abuse, and AI-assisted attacks against identity systems.
• Evaluate emerging AI-enabled identity threats and recommend improvements to authentication, authorization, governance, and monitoring controls.
• Support continuous improvement of zero trust, phishing-resistant authentication, conditional access, privileged access, and identity detection and response capabilities.

Required Qualifications

• Bachelor’s degree in cybersecurity, computer science, information technology, data science, engineering, or a related field, or equivalent practical experience.
• Five or more years of experience in identity and access management, cybersecurity engineering, security architecture, cloud security, or related technology roles.
• Hands-on experience with IAM platforms, identity governance, access management, privileged access management, directory services, SSO, MFA, federation, and lifecycle management.
• Practical experience applying automation, analytics, AI, machine learning, or data science techniques to security, risk, identity, or operational use cases.
• Strong understanding of authentication and authorization protocols such as SAML, OAuth 2.0, OpenID Connect, SCIM, LDAP, Kerberos, and modern API security patterns.
• Experience with scripting or software development using Python, PowerShell, JavaScript, Java, C#, Go, or similar languages.
• Knowledge of cloud identity and security services across Microsoft Azure, AWS, or Google Cloud Platform.
• Experience working with structured and unstructured data, query languages, data pipelines, log analytics, and visualization tools.
• Strong analytical, troubleshooting, communication, and stakeholder management skills.

Preferred Qualifications

• Experience with Microsoft Entra ID, Entra ID Governance, Entra Permissions Management, Microsoft Defender, Sentinel, Purview, Azure Key Vault, or related Microsoft security capabilities.
• Experience with IGA, PAM, and access management platforms such as SailPoint, Saviynt, CyberArk, One Identity, Okta, Ping Identity, ForgeRock, or similar technologies.
• Experience with AI or ML frameworks, large language model platforms, vector databases, graph analytics, feature engineering, model evaluation, or MLOps and LLMOps practices.
• Familiarity with identity threat detection and response, user and entity behavior analytics, security orchestration, SIEM, SOAR, and threat hunting.
• Knowledge of responsible AI, model risk management, privacy engineering, data protection, and AI governance frameworks.
• Experience supporting regulated environments such as financial services, insurance, healthcare, government, or other compliance-driven industries.

Professional certifications such as CISSP, CISM, CCSP, Microsoft Security certifications, Azure certifications, AWS Security Specialty, GIAC, Certified Identity and Access Manager, or AI/security-related certifications

At Gallagher, we believe supporting our colleagues goes far beyond the role itself. For more information, visit our Benefits page.

• Competitive compensation
• Comprehensive benefits programs designed to support your well-being 
• Career development opportunities and ongoing learning 
• A collaborative, people-first culture with accessible leadership 
• The opportunity to do meaningful work with global reach and local impact 

At Gallagher, we are dedicated to building an inclusive and authentic workplace. If your past experience doesn’t align perfectly, we encourage you to join our Talent Community to stay connected to additional career opportunities. At times, we will consider transferable skills from previous roles.

Gallagher is an affirmative action/equal opportunity employer (Minorities/Females/Veterans/Disabled)