1 day ago
Responsibilities
- Own joiner, mover, and leaver identity lifecycle provisioning and deprovisioning using automated RBAC/ABAC models and entitlement-inventory verification.
- Own Conditional Access, phishing-resistant MFA, privileged access, Zero Trust identity controls, least privilege, and just-in-time elevation.
- Own directory and federation across Entra ID, single sign-on, SAML, OIDC, and OAuth2.
- Manage secrets and non-human identities, including API keys, service accounts, workload identity, and an owner registry.
- Govern key access and separation of duties while another team operates the key management system.
- Build identity lifecycle and access controls as reviewable, version-controlled infrastructure using Terraform and policy-as-code.
- Define and maintain identity-verification standards for password resets, MFA resets, and device enrollment.
- Deliver enforced Conditional Access for PHI-facing applications, automated lifecycle workflows, a secrets golden path, strong privileged-account MFA, and documented runbooks.
- Set technical standards and verification bars while coordinating with Service Delivery, Cloud Engineering, HR, and Governance, Risk & Compliance teams.
Requirements
- Eight or more years of identity and access management experience, including principal- or staff-level ownership of an identity control plane.
- Deep Microsoft Entra ID engineering experience with Conditional Access, phishing-resistant MFA, single sign-on, federation, and enforcement verification.
- Experience automating identity lifecycle processes across cloud, SaaS, and privileged systems with RBAC/ABAC and entitlement verification.
- Experience designing Zero Trust identity controls, least privilege, just-in-time access, and risk-based or adaptive access.
- Identity governance and administration platform engineering experience, including privileged access management.
- Automation and scripting experience with PowerShell, Python, or similar tools.
- Identity-as-code and policy-as-code experience using Terraform and source-controlled change management such as GitHub.
- Experience with secrets, API keys, service accounts, workload identity, owner registries, key access governance, and separation of duties.
- Ability to act as a technical authority without formal people-management responsibility and work directly with a CISO.
- Bachelor’s degree in a relevant field or equivalent professional experience.
- Preferred experience includes healthcare or other regulated environments, Saviynt, PAM, Azure PIM, Keeper, passkeys, FIDO2, NIST SP 800-63 Rev. 4, and relevant identity certifications such as Microsoft Identity and Access Administrator or CIMP.
Benefits
- Remote work arrangement.
- Medical, dental, and vision insurance.
- Short- and long-term disability insurance.
- Life insurance.
- 401(k) with company match.
- Flexible time off.
- Paid parental leave.
- Individual-contributor role with a path toward broader leadership as the identity function grows.
About Lantern
Lantern builds a specialty care platform that connects members of self-insured employers and labor funds with a nationwide Network of Excellence for surgery, cancer care, infusions, and other planned procedures. It sells bundled-case surgical and specialty benefits, pairing each member with care advocates and nurses to navigate treatment and reduce medical spend. The privately held company was founded in 2011 and is headquartered in Dallas, Texas.