India - Security Engineer II

About The Job:

• Salesforce’s Cloud Security team is looking for a Senior IAM Engineer to operate, maintain, and help improve the identity and access management platforms and integrations that support authentication, federation, access management, and identity lifecycle processes across a multi-cloud environment spanning AWS, Azure, GCP, and OCI.
• You will be working within an established IAM framework and will be expected to contribute improvements as opportunities arise.
• The work includes day-to-day IAM operations, application onboarding, and troubleshooting.
• This is a night shift position (22:00–07:00 IST) providing real-time coverage during US business hours.
• You’ll work as part of a global IAM operations team supporting a large-scale enterprise infrastructure that serves millions of users worldwide.

Essential Job Functions:
Identity & Access Management

• Operate and maintain enterprise identity services across authentication, federation, access management, lifecycle, and governance.
• Provision, modify, and revoke user and service account access across AWS, Azure, GCP, and OCI.
• Create and manage IAM roles, policies, permission sets, service principals, managed identities, and service accounts.
• Implement and enforce role-based access control (RBAC).
• Implement and support SSO, MFA, conditional access, federation, OAuth, OpenID Connect, SAML, SCIM, and directory integrations.
• Conduct periodic access reviews and access certifications to enforce least-privilege.
• Manage federated access and single sign-on (SSO) integrations across cloud providers and enterprise applications.

Cloud Account Lifecycle & Onboarding

• Onboard new cloud accounts, subscriptions, and projects — configuring IAM controls, security baselines, and team access.
• Manage the full lifecycle of cloud accounts from creation through decommissioning.
• Create reusable standards, patterns, automation, and runbooks for identity integrations and operations.
• Coordinate with infrastructure, networking, platform, and product teams during onboarding.

Security, Compliance & Governance

• Investigate overly permissive roles, unused credentials, and inactive service accounts.
• Assess identity platforms and access patterns to reduce risk and support audit and compliance needs.
• Support compliance audits — prepare evidence, validate access controls, enforce policy.
• Assist in remediation efforts and incident response as needed — collaborating with operations and engineering teams to resolve access-related issues.
• Enforce IAM policies, naming conventions, and tagging standards across cloud environments.

Automation & Operational Excellence

• Assist in IAM automation efforts as needed — contributing to scripts, tools, and process improvements.
• Improve identity service reliability through incident response and security hardening.
• Contribute to the identity roadmap by recommending improvements to security, usability, and operational efficiency.
• Document procedures, runbooks, and knowledge base articles for IAM operations.
• Process access requests and change requests via ticketing systems, ensuring SLAs and security standards are met.
• Participate in weekend on-call rotation (8-hour shifts).
• Perform structured shift handoffs with the day team to ensure continuity across time zones.

Qualifications:
Minimum Qualifications

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field, or equivalent experience.
• A minimum of 5 years of experience engineering identity and access management solutions across authentication, federation, access control, lifecycle management, access governance, or related identity domains.
• Demonstrable experience operating and maintaining IAM capabilities across enterprise environments, including public cloud and on-premises systems.
• Deep understanding of identity and authentication protocols such as SAML, OAuth, OpenID Connect, LDAP, Kerberos, and SCIM.
• Experience with enterprise identity platforms such as Okta, Microsoft Entra ID, Ping, SailPoint, Saviynt, CyberArk, or similar technologies.
• Strong hands-on experience with cloud IAM across at least two of: AWS, Azure, GCP.

AWS IAM

• IAM users, groups, roles, and policies (identity-based, resource-based, permission boundaries).
• Service Control Policies (SCPs) and AWS Organizations.
• AWS Control Tower, account factory, and landing zone concepts.
• Cross-account access, role assumption, and external ID patterns.
• AWS SSO / IAM Identity Center.
• Service-linked roles and service accounts.
• CloudTrail, Config Rules, and Access Analyzer for IAM auditing.

Azure IAM

• Azure Active Directory / Microsoft Entra ID — users, groups, roles, administrative units.
• Role-based access control (RBAC) — built-in and custom role definitions.
• Service principals, managed identities (system-assigned and user-assigned).
• App registrations, federated credentials, and workload identity federation.
• Conditional Access policies, Privileged Identity Management (PIM).
• Management groups, subscriptions, and resource group scoping.
• Azure Key Vault access policies and RBAC.

GCP IAM

• IAM roles (basic, predefined, custom) and policy bindings.
• Service accounts — creation, key management, impersonation, short-lived credentials.
• Workload Identity and Workload Identity Federation.
• Organization policies, folders, and project-level IAM.
• GKE IAM — Kubernetes RBAC integration, namespace-level bindings.
• Cloud Asset Inventory and Policy Analyzer for access auditing.
• VPC Service Controls and access context.

General Skills

• Working knowledge of MFA, conditional access, privileged access, identity lifecycle processes, access reviews, and least-privilege access models.
• Identity federation protocols — SAML 2.0, OpenID Connect (OIDC), OAuth 2.0, SCIM, LDAP, Kerberos.
• Strong knowledge of security standards, control frameworks, risk management practices, and identity security best practices.
• Directory services — Active Directory, LDAP, Okta, or similar IdP administration.
• Experience with ticketing/ITSM systems (Jira, ServiceNow, or similar).
• Exceptional problem-solving and analytical skills with the ability to troubleshoot complex technical issues across distributed systems.
• Excellent communication and collaboration abilities — working effectively with technical teams, business stakeholders, and application owners across time zones.
• Proven ability to work independently, prioritize effectively, and manage multiple engineering initiatives simultaneously.

Preferred Qualifications

• Experience with automation of IAM processes — provisioning, deprovisioning, access reviews, compliance reporting.
• Proficiency in scripting — Python, Bash, PowerShell, JavaScript, or similar.
• OCI (Oracle Cloud Infrastructure) experience — compartments, policies, dynamic groups, vault and key management.
• Certification in relevant security, identity, or cloud technologies such as CISSP, SSCP, CCSP, Microsoft AZ-500, Okta Certified Professional, AWS Certified Security – Specialty, GCP Professional Cloud Security Engineer, or similar.
• Experience with privileged access management (PAM) — CyberArk, BeyondTrust, or cloud-native PIM/PUM.
• Key management and encryption — Azure Key Vault, AWS KMS, GCP Cloud KMS, key rotation policies.
• Knowledge of DevOps, infrastructure-as-code (Terraform, CloudFormation, Pulumi, Bicep), CI/CD pipelines, and API integrations.
• CI/CD pipeline security — securing service accounts and credentials in deployment pipelines.
• Experience leading technical projects, mentoring engineers, or influencing cross-functional technical direction.
• Experience working in a 24/7 operations environment with shift-based coverage and structured handoffs.

How to Apply: Interested candidates are encouraged to respond/submit their updated resumes, and for additional job opportunities, please visitJobs In India – VARITE.

Unlock Rewards: Refer Candidates and Earn.

If you're not available or interested in this opportunity, please pass this along to anyone in your network who might be a good fit and interested in our open positions. VARITE offers a Candidate Referral program, where you'll receive a one-time referral bonus based on the following scale if the preferred candidate completes a three-month assignment with VARITE.

Experience Level Bonus Referral:

• 0-2 years - INR 5,000
• 2-6 years - INR 7,500
• 6+ years - INR 10,000

About VARITE: VARITE is a global staffing and IT consulting company providing technical consulting and team augmentation services to Fortune 500 Companies in USA, UK, CANADA and INDIA. VARITE is currently a primary and direct vendor to the leading corporations in the verticals of Networking, Cloud Infrastructure, Hardware and Software, Digital Marketing and Media Solutions, Clinical Diagnostics, Utilities, Gaming and Entertainment, and Financial Services.

Equal Opportunity Employer:

VARITE is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. We do not discriminate based on race, color, religion, sex, sexual orientation, gender identity or expression, national origin, age, marital status, veteran status, or disability status.