Azure Identity & Access Management Engineer

We’re building a world of health around every individual — shaping a more connected, convenient and compassionate health experience. At CVS Health®, you’ll be surrounded by passionate colleagues who care deeply, innovate with purpose, hold ourselves accountable and prioritize safety and quality in everything we do. Join us and be part of something bigger – helping to simplify health care one person, one family and one community at a time.

Position Summary

The Identity and Access Management Engineer is responsible for contributing to the design, engineering, and supporting identity capabilities across workforce, privileged, cloud, and customer-facing environments. A primary focus of the role is helping establish and mature a new Customer Identity and Access Management (CIAM) capability, creating the identity architecture, engineering patterns, integrations, and operational foundations required to securely support customer-facing digital applications at scale.

This engineer will work across Microsoft Azure and Microsoft Entra ID, applying identity engineering principles to both enterprise Workforce IAM and CIAM. The role spans authentication, authorization, federation, identity lifecycle management, privileged access, and application identity, with particular emphasis on integrating customer identity services with applications and APIs using OAuth 2.0 and OpenID Connect (OIDC). These capabilities must balance security and privacy requirements with availability, scalability, reliability, and customer experience.

Role Responsibilities:

Azure & Enterprise IAM

• Design, implement, and support identity and access solutions using Microsoft Entra ID and Azure.
• Engineer authentication, authorization, federation, SSO, MFA, Conditional Access, and role-based access control solutions.
• Support hybrid identity integrations between Microsoft Entra ID, Active Directory, cloud platforms, SaaS applications, and enterprise applications.
• Implement secure identity lifecycle processes supporting provisioning, access changes, and deprovisioning.
• Design and support privileged access controls, including Privileged Identity Management (PIM) and least-privilege access models.
• Implement service principal, workload identity, managed identity, and application identity controls within Azure environments.
• Support identity governance activities including access reviews, entitlement management, role governance, and remediation of excessive access.

Customer Identity & Access Management (CIAM)

• Design, implement, and support CIAM solutions for customer-facing web, mobile, and digital applications.
• Implement secure customer registration, sign-in, authentication, account recovery, and identity lifecycle patterns.
• Integrate customer identity services with applications and APIs using standards including OAuth 2.0 and OpenID Connect (OIDC).
• Partner with application engineering teams to integrate authentication and authorization into application architectures.
• Support federation and external identity integrations across customer and partner ecosystems.
• Troubleshoot complex login, token, federation, authorization, and application integration issues.
• Ensure CIAM implementations balance security, customer experience, availability, scalability, and privacy requirements.

Cloud Identity & Security

• Implement identity controls for Azure cloud resources following least privilege and zero-standing-privilege principles.
• Design Azure RBAC models and access patterns for cloud infrastructure, applications, APIs, workloads, and administrative functions.
• Review identity configurations to identify excessive permissions, unused access, privileged roles, and other identity-related risk.
• Partner with Cloud Security and DevSecOps teams to embed identity controls into cloud engineering practices.
• Support Infrastructure-as-Code and automated identity configuration using technologies such as Terraform, PowerShell, Microsoft Graph, APIs, and CI/CD pipelines.
• Build monitoring and operational capabilities for cloud identity services and authentication failures.

Engineering & Operations

• Serve as a technical escalation point for complex identity and authentication issues.
• Participate in incident response involving compromised identities, authentication failures, privileged access, or unauthorized access.
• Develop reusable engineering patterns, technical standards, runbooks, and reference architectures.
• Automate provisioning, access management, reporting, and identity governance processes where practical.
• Support production availability and operational reliability of business-critical identity services.
• Partner with Security, Infrastructure, Architecture, GRC, Application Development, and business teams to deliver secure identity solutions.

Required Qualifications

• 3+ years of experience in Identity & Access Management, security engineering, cloud engineering, or a related discipline.
• 3+ years of hands-on experience with Microsoft Entra ID and Azure identity services.
• 3+ years of experience implementing CIAM or external/customer identity solutions.
• 3+ years of experience implementing enterprise SSO, MFA, Conditional Access, RBAC, federation, and identity lifecycle management.
• 3+ years with OAuth 2.0, OpenID Connect (OIDC), SAML, authentication, authorization, tokens, and federation.
• 2+ years of experience integrating IAM capabilities with enterprise web applications, APIs, and cloud-native applications.
• 2+ years of experience working with APIs, scripting, or automation technologies such as Microsoft Graph, PowerShell, Python, or Terraform.

Preferred Qualifications

• Ability to work effectively with application developers, security engineers, cloud engineers, architects, and business stakeholders.
• Deep experience with Microsoft Entra External ID / CIAM capabilities.
• Experience implementing CIAM for high-volume customer-facing digital applications.
• Experience with Microsoft Entra ID Governance, PIM, Conditional Access, workload identities, managed identities, and application registrations.
• Experience integrating identity solutions into Azure-native applications and API architectures.
• Infrastructure-as-Code experience with Terraform or similar tooling.
• Experience with PAM platforms such as CyberArk, HashiCorp Vault, BeyondTrust, or Delinea. These technologies are also represented in your current IAM role requirements.
• Experience working in healthcare or another highly regulated industry.
• Familiarity with security and compliance requirements applicable to enterprise identity environments.
• Relevant certifications such as Microsoft SC-300, AZ-500, CISSP, CISM, or equivalent cloud/security credentials. SC-300, AZ-500, CISSP, and CISM also appear among the preferred credentials in your existing IAM requisition.

Education

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related discipline, or equivalent relevant professional experience.

Anticipated Weekly Hours

Time Type

Pay Range

The typical pay range for this role is:

This pay range represents the base hourly rate or base annual full-time salary for all positions in the job grade within which this position falls. The actual base salary offer will depend on a variety of factors including experience, education, geography and other relevant factors. This position is eligible for a CVS Health bonus, commission or short-term incentive program in addition to the base pay range listed above.

Our people fuel our future. Our teams reflect the customers, patients, members and communities we serve and we are committed to fostering a workplace where every colleague feels valued and that they belong.

Great benefits for great people

We take pride in offering a comprehensive and competitive mix of pay and benefits that reflects our commitment to our colleagues and their families.

Additional details about available benefits are provided during the application process and on Benefits Moments.

Qualified applicants with arrest or conviction records will be considered for employment in accordance with all federal, state and local laws.

About us