Senior Engineer, Workforce IAM

Cardinal Health, Inc. (NYSE: CAH) is a global healthcare services and products company. We provide customized solutions for hospitals, healthcare systems, pharmacies, ambulatory surgery centers, clinical laboratories, physician offices and patients in the home. We are a distributor of pharmaceuticals and specialty products; a global manufacturer and distributor of medical and laboratory products; an operator of nuclear pharmacies and manufacturing facilities; and a provider of performance and data solutions. Working to be healthcare’s most trusted partner, our customer-centric focus drives continuous improvement and leads to innovative solutions that improve the lives of people every day. With approximately 50,000 employees worldwide, Cardinal Health ranks among the top fifteen in the Fortune 500. Department Overview: Information Security and Risk develops, implements, and enforces security controls to protect the organization's technology assets from intentional or inadvertent modification, disclosure, or destruction. The function of this job family is to ensure secure, authorized, and compliant access to the organization's data, systems, and physical resources . It focuses on defining, creating, managing, and governing digital identities and their associated access privileges to protect the enterprise from security breaches, insider threats, and regulatory non-compliance We are seeking a highly skilled and experienced Identity and Access Management (IAM) Senior Engineer to join our Workforce Identity team. In this role, you will architect, scale, and modernize the systems that secure over 50,000 global employees, contractors, and critical distribution operations. You will drive identity strategy across a hyper-scale, hybrid multi-cloud environment, spearhead rapid M&A integrations, champion Zero Standing Privilege (ZSP), and architect next-generation non-human and frontline identity solutions. Responsibilities: M&A Architecture & Federation Strategy Architect repeatable, high-velocity identity blueprints for Mergers, Acquisitions, and Divestitures, reducing subsidiary integration timeframes from months to weeks. Lead cross-domain identity consolidation across disparate identity providers (Okta, Entra ID, Ping) and divergent enterprise directories. Design robust cross-cloud federation, B2B collaboration frameworks, and tenant boundary governance. Lead IAM technical workstreams for Mergers, Acquisitions, and Divestitures. Consolidate disparate identity providers (IdPs) into a unified enterprise SSO platform. Design and execute cross-domain authentication and federation strategies. Lead IAM discovery, identity migration, and system consolidation for newly acquired business entities. Direct experience migrating users, mapping attributes, and consolidating divergent directories. Architecture influence and decision-making Define enterprise IAM architecture standards: Formulate technical standards, architectural patterns, and reference blueprints for enterprise SSO, Identity Governance and Administration (IGA), and directory services. Technical authority and vendor SoW evaluation: Act as a critical architectural authority to evaluate third-party integration patterns, challenge vendor Statements of Work (SoWs) for high-complexity migrations (e.g., ADFS to Okta) and establish technical decommissioning strategies for legacy identity platforms. Hybrid and multi-cloud IAM Architect hybrid and multi-cloud IAM bridges: Design, govern, and scale secure identity bridges linking legacy on-premises infrastructure (Active Directory, ADFS) with hyper-scale multi-cloud environments (GCP, AWS, Azure/Entra ID) and SaaS ecosystems (Okta, SailPoint). Privileged Access and JIT governance: Define and architect robust Zero Standing Privilege (ZSP) and Just-In-Time (JIT) access control patterns using Privileged Access Management (PAM - CyberArk, HashiCorp Vault) and Cloud Infrastructure Entitlement Management (CIEM) to reduce the on-premises and cloud attack surface. Emerging tech trends and business growth Modern Identity roadmaps (NHIM and ISPM): Research, evaluate, and integrate emerging industry trends—such as Non-Human Identity Management (NHIM), Identity Security Posture Management (ISPM), and agentic/AI security controls—into the long-term IAM roadmap. Agile Identity for business scale: Ensure identity systems are agile and scalable enough to support Cardinal Health's rapid business expansion, M&A pipeline, and digital healthcare operations without introducing friction IGA Integrations Design repeatable, high-velocity identity blueprints for Mergers, Acquisitions, and Divestitures, reducing subsidiary integration timeframes from months to weeks. Lead cross-domain identity consolidation across disparate identity providers (Okta, Entra ID, Ping) and divergent enterprise directories. Design robust cross-cloud federation, B2B collaboration frameworks, and tenant boundary governance Authoritative Source Integration: Design and implement seamless integrations with HRMS platforms (e.g., Workday, SuccessFactors, PeopleSoft) to drive the identity lifecycle. Formulate policy-driven access models (RBAC/PBAC) and automated Segregation of Duties (SoD) frameworks meeting strict SOX ITGC, HIPAA, and GDPR requirements. Architect specialized authentication solutions (contactless RFID badge tap-and-go, biometric FIDO2 smart cards, shared kiosk sessions) supporting nuclear pharmacies, manufacturing plants, and distribution centers. Design "Single Pane of Glass" self-service capabilities for people leaders to proactively monitor and right-size direct report access. Partner with IAM Engineering to establish self-healing provisioning patterns achieving 99.999% core availability Application Onboarding: Design, develop, and configure SailPoint connectors for Active Directory (AD), JDBC, and Web Services (REST/SOAP). Automated Provisioning: Configure and maintain Birthright provisioning to ensure immediate, policy-driven access for joiners on day one. Process Automation: Automate lifecycle events (Joiner, Mover, Leaver) and request-based provisioning workflows. Expand Cloud Infrastructure Entitlement Management (CIEM) to continuously discover and eliminate over-privileged assignments Automation and Workflows Develop automated workflows to streamline user onboarding, transitions, and offboarding. Build API-driven automations to reduce manual provisioning overhead. Implement infrastructure-as-code (IaC) principles for IAM configurations. Security Policy and Compliance Ensure IAM systems and processes comply with regulatory requirements (e.g., GDPR, HIPAA, SOX) and internal security policies, providing auditable records of access activities. Protect against data breaches by ensuring only authorized personnel can access sensitive information. Solution Design & Implementation: Design, implement, and maintain IAM solutions including Single Sign-On (SSO), Identity life cycle management, IGA and PAM. Collaboration & Communication: Coordinate cross-functional teams, including Information Security, IT Operations, HR, and Application Development, to ensure effective IAM implementation and seamless integration with business processes. Communicate complex security concepts to technical and non-technical stakeholders. Documentation & Best Practices: Develop, review, and maintain comprehensive technical documentation, including architecture diagrams, configuration guides, and operational procedures. Stay up-to-date with IAM best practices, regulatory requirements, and security trends. Qualifications: Education: Bachelor's degree in Computer Science, Information Technology, Information Security, or a related field, or equivalent practical experience. Experience: 10+ years in Information Security and Identity Management, with at least 5+ years operating as a Lead or Principal Enterprise IAM Architect within a Fortune 500 or hyper-scale enterprise preferred. Technical Expertise: Deep theoretical and practical command of OAuth 2.0, OpenID Connect (OIDC), SAML 2.0, SCIM 2.0, FIDO2/WebAuthn, and Kerberos. Proven architectural authority across enterprise IdPs (Microsoft Entra ID, Okta), IGA platforms (SailPoint IdentityIQ / Identity Security Cloud), and PAM solutions (CyberArk, HashiCorp Vault). Demonstrated success leading identity discovery, tenant consolidation, and domain migration workstreams across complex, multi-entity corporate structures. Comprehensive familiarity with SOX 404 ITGC controls, HIPAA Security Rule, and international data sovereignty frameworks. Exceptional executive communication, stakeholder diplomacy, and ability to translate cryptographic/identity concepts into clear business risk decisions . Ability to manage multiple priorities and meet tight deadlines in a fast-paced M&A environment. Adaptability to stay ahead of evolving IAM technologies and security threats. What is expected of you and others at this level Applies advanced knowledge and understanding of concepts, principles, and technical capabilities to manage a wide variety of projects Participates in the development of policies and procedures to achieve specific goals Recommends new practices, processes, metrics, or models Works on or may lead complex projects of large scope Projects may have significant and long-term impact Provides solutions which may set precedent Independently determines method for completion of new projects Receives guidance on overall project objectives Acts as a mentor to less experienced colleagues Anticipated salary range: $125,300 - $178,900 Bonus eligible: Yes Benefits: Cardinal Health offers a wide variety of benefits and programs to support health and well-being. Medical, dental and vision coverage Paid time off plan Health savings account (HSA) 401k savings plan Access to wages before pay day with myFlexPay Flexible spending accounts (FSAs) Short- and long-term disability coverage Work-Life resources Paid parental leave Healthy lifestyle programs Application window anticipated to close: 11/23/2026 *if interested in opportunity, please submit application as soon as possible. The salary range listed is an estimate. Pay at Cardinal Health is determined by multiple factors including, but not limited to, a candidate’s geographical location, relevant education, experience and skills and an evaluation of internal pay equity. Cardinal Health supports an inclusive workplace that values diversity of thought, experience and background. We celebrate the power of our differences to create better solutions for our customers by ensuring employees can be their authentic selves each day. Cardinal Health is an Equal Opportunity employer. All qualified applicants will receive consideration for employment without regard to race, religion, color, national origin, ancestry, age, physical or mental disability, sex, sexual orientation, gender identity/expression, pregnancy, veteran status, marital status, creed, status with regard to public assistance, genetic status or any other status protected by federal, state or local law. To read and review this privacy notice click here