IAM AI Engineer

Introduction

Welcome to Gallagher - a global community of people who bring bold ideas, deep expertise, and a shared commitment to doing what’s right. We help clients navigate complexity with confidence by empowering businesses, communities, and individuals to thrive. At Gallagher, you’ll find more than a job; you’ll find a culture built on trust, driven by collaboration, and sustained by the belief that we’re better together. Whether you join us in a client-facing role or as part of our brokerage division, our benefits and HR consulting division, or our corporate team, you’ll have the opportunity to grow your career, make an impact, and be part of something bigger.

Experience a workplace where you’re encouraged to be yourself, supported to succeed, and inspired to keep learning. That’s what it means to live The Gallagher Way.

Overview

The Identity and Access Management AI Engineer is responsible for designing, engineering, and operationalizing AI-enabled identity security capabilities across the enterprise. This role combines deep IAM engineering expertise with artificial intelligence, machine learning, automation, and analytics to strengthen identity controls, reduce access risk, improve operational efficiency, and detect emerging identity-based threats.

The engineer will help modernize identity services by applying AI to access governance, privileged access, authentication risk, identity lifecycle management, entitlement analysis, anomaly detection, and automated decision support. This includes helping deploy and operationalize the built-in AI capabilities expected in the next version of Identity Manager. This position partners closely with IAM, the Corporate AI Team, cyber defense, security architecture, infrastructure, cloud, data science, risk, compliance, and application teams to deliver secure, scalable, and compliant identity solutions.

How you'll make an impact

• Design, build, and support AI-driven IAM capabilities that improve identity governance, access management, privileged access management, and authentication risk controls.
• Develop models, analytics, and automation that identify excessive access, toxic entitlement combinations, segregation of duties conflicts, dormant accounts, orphaned identities, risky privileged access, and abnormal authentication behavior.
• Apply machine learning, rules-based analytics, and graph-based identity intelligence to detect access anomalies and recommend remediation actions.
• Engineer AI-assisted workflows that support access request reviews, entitlement certification, role mining, policy recommendations, and identity lifecycle decisions.
• Partner with IAM platform owners to integrate AI capabilities into identity governance, access management, PAM, directory, and cloud identity tools.
• Lead or support deployment, configuration, governance, and adoption of built-in AI capabilities delivered in the next version of Identity Manager.
• Identity Governance and Access Intelligence
• Enhance identity governance processes through automated access insights, risk scoring, peer-group analysis, and entitlement usage analytics.
• Support role-based access control, attribute-based access control, policy-based access control, and least-privilege access models using data-driven recommendations.
• Design and tune access risk models that prioritize remediation based on business criticality, privilege level, account type, data sensitivity, and user behavior.
• Improve access certification campaigns by reducing reviewer fatigue, identifying low-risk approvals, and surfacing high-risk exceptions for focused review.
• Develop reporting and dashboards that provide IAM leadership, risk teams, auditors, and application owners with actionable identity risk insights.
• AI Security and Responsible AI Controls
• Embed security, privacy, and responsible AI principles into IAM AI solutions from design through production operations.
• Assess AI-enabled identity use cases for risks such as data leakage, prompt injection, model misuse, biased recommendations, excessive automation, and unauthorized access to sensitive identity data.
• Implement controls for model access, prompt governance, data minimization, audit logging, approval workflows, and human-in-the-loop decision-making.
• Collaborate with legal, privacy, compliance, and risk stakeholders to ensure IAM AI solutions align with internal policies, regulatory obligations, and industry frameworks.
• Work closely with the Corporate AI Team to ensure IAM AI solutions align with enterprise AI strategy, approved AI architecture patterns, model governance, responsible AI standards, and shared AI platform capabilities.
• Document AI decision logic, data sources, assumptions, limitations, and control requirements to support auditability and transparency.
• Platform Integration and Automation
• Integrate IAM AI capabilities with enterprise platforms such as Microsoft Entra ID, SailPoint, Saviynt, Okta, Ping, CyberArk, One Identity, ServiceNow, SIEM, SOAR, cloud platforms, and data lake environments.
• Develop secure APIs, scripts, pipelines, and automation patterns that streamline identity lifecycle management, access provisioning, deprovisioning, review, and remediation.
• Use infrastructure as code, DevSecOps, and CI/CD practices to deploy reliable, repeatable, and secure IAM AI services.
• Partner with data engineering teams to ingest, normalize, protect, and analyze identity, access, authentication, privilege, HR, application, and security event data.
• Coordinate with the Corporate AI Team on AI platform integration, approved model usage, reusable AI services, monitoring practices, and enterprise AI deployment patterns.
• Ensure solutions are resilient, observable, scalable, and aligned with enterprise architecture standards.
• Threat Detection and Identity Defense
• Develop and tune identity threat detection analytics for suspicious authentication, impossible travel, abnormal privilege use, anomalous service account behavior, risky API access, and unusual entitlement changes.
• Support cyber defense teams by correlating IAM telemetry with endpoint, network, cloud, application, and threat intelligence data.
• Contribute to incident response playbooks for identity compromise, credential misuse, privileged access abuse, and AI-assisted attacks against identity systems.
• Evaluate emerging AI-enabled identity threats and recommend improvements to authentication, authorization, governance, and monitoring controls.
• Support continuous improvement of zero trust, phishing-resistant authentication, conditional access, privileged access, and identity detection and response capabilities.

About You

Required Qualifications

• Bachelor’s degree in cybersecurity, computer science, information technology, data science, engineering, or a related field, or equivalent practical experience.
• Five or more years of experience in identity and access management, cybersecurity engineering, security architecture, cloud security, or related technology roles.
• Hands-on experience with IAM platforms, identity governance, access management, privileged access management, directory services, SSO, MFA, federation, and lifecycle management.
• Practical experience applying automation, analytics, AI, machine learning, or data science techniques to security, risk, identity, or operational use cases.
• Strong understanding of authentication and authorization protocols such as SAML, OAuth 2.0, OpenID Connect, SCIM, LDAP, Kerberos, and modern API security patterns.
• Experience with scripting or software development using Python, PowerShell, JavaScript, Java, C#, Go, or similar languages.
• Knowledge of cloud identity and security services across Microsoft Azure, AWS, or Google Cloud Platform.
• Experience working with structured and unstructured data, query languages, data pipelines, log analytics, and visualization tools.
• Strong analytical, troubleshooting, communication, and stakeholder management skills.

Preferred Qualifications

• Experience with Microsoft Entra ID, Entra ID Governance, Entra Permissions Management, Microsoft Defender, Sentinel, Purview, Azure Key Vault, or related Microsoft security capabilities.
• Experience with IGA, PAM, and access management platforms such as SailPoint, Saviynt, CyberArk, One Identity, Okta, Ping Identity, ForgeRock, or similar technologies.
• Experience with AI or ML frameworks, large language model platforms, vector databases, graph analytics, feature engineering, model evaluation, or MLOps and LLMOps practices.
• Familiarity with identity threat detection and response, user and entity behavior analytics, security orchestration, SIEM, SOAR, and threat hunting.
• Knowledge of responsible AI, model risk management, privacy engineering, data protection, and AI governance frameworks.
• Experience supporting regulated environments such as financial services, insurance, healthcare, government, or other compliance-driven industries.
• Professional certifications such as CISSP, CISM, CCSP, Microsoft Security certifications, Azure certifications, AWS Security Specialty, GIAC, Certified Identity and Access Manager, or AI/security-related certifications

Compensation and benefits

At Gallagher, we believe supporting our colleagues goes far beyond the role itself. For more information, visit our Benefits page.

Competitive compensation

Comprehensive benefits programs designed to support your well-being

Career development opportunities and ongoing learning

A collaborative, people-first culture with accessible leadership

The opportunity to do meaningful work with global reach and local impact

At Gallagher, we are dedicated to building an inclusive and authentic workplace. If your past experience doesn’t align perfectly, we encourage you to join our Talent Community to stay connected to additional career opportunities. At times, we will consider transferable skills from previous roles.

Gallagher is an affirmative action/equal opportunity employer (Minorities/Females/Veterans/Disabled)