Agentic IAM Engineer (contract)

Please note that this is a contract role providing services to Hilton through Talent Solutions. If you are selected for this role, you will be employed by Talent Solutions and will not be an employee of Hilton. Contract workers are not employees of Hilton or any of its subsidiaries, nor will they be eligible for Hilton benefits.

***This is a US based hybrid position at one of our corporate offices in McLean, VA, Dallas, TX or Memphis, TN 2-3 days/week***

Job Summary:

We are seeking a highly skilled and experienced identity engineering professional to lead the implementation, configuration, automation, operation, and troubleshooting of identity platforms supporting agent identities within a complex enterprise environment. This role is at the forefront of an emerging and rapidly evolving discipline, responsible for turning agentic identity and access management strategy into reliable, scalable operating capability. The position requires deep technical expertise across both traditional workforce identity platforms and cutting-edge agentic identity solutions, with a strong emphasis on integrating these capabilities across enterprise AI, security, cloud, and application stacks. A secondary but equally important focus involves identity integration engineering, including onboarding new applications and identity data sources into the IAM data warehouse to strengthen governance, reporting, monitoring, and audit readiness. This is a contract-to-hire opportunity, and the successful candidate will be expected to demonstrate the technical depth, leadership behaviors, collaboration skills, and delivery discipline consistent with a permanent role, while building durable documentation, operating practices, and knowledge transfer to ensure long-term supportability and scalability.

Responsibilities:

• Deploy, configure, integrate, and operate identity capabilities for AI agents, workloads, service accounts, and other non-human identities.
• Engineer SailPoint Agentic Fabric, PingFederate, PingAuthorize, and Ping Agent IAM Core capabilities for discovery, governance, runtime authorization, authentication, lifecycle control, and audit.
• Integrate agentic identity controls with enterprise identity platforms, AI platforms, API and MCP gateways, cloud platforms, directories, secrets platforms, monitoring tools, and business applications.
• Build repeatable implementation patterns for agent onboarding, ownership, policy enforcement, access certification, provisioning, deprovisioning, authentication, authorization, and kill-switch processes.
• Build and maintain provisioning workflows, connectors, integrations, authentication policies, and data stores for non-human identity data.
• Leverage evolving capabilities to maintain updated non-human and agentic identity inventories and ownership, operate and enforce lifecycle controls, produce reporting, detect anomalies, and perform mitigation activities.
• Establish platform operating procedures, installation plans, and configuration runbooks covering agent platform onboarding, connector configuration, NHI discovery, lifecycle workflows, certifications, OAuth client registration, credential management, authorization policies, and SIEM monitoring controls.
• Plan and execute platform upgrades, migrations, configuration changes, and technical remediation activities.
• Provide advanced incident support and diagnose complex failures across identity, application, network, cloud, data, and authentication layers.
• Improve platform reliability, scalability, security, observability, and performance through automation, monitoring, testing, and engineering standards.
• Develop secure APIs, scripts, and automation routines that streamline provisioning, operational processing, monitoring, access governance, and compliance evidence collection.
• Integrate new human and non-human identity and access data sources into the IAM data warehouse using reliable extraction, transformation, validation, reconciliation, and error-handling patterns.
• Create monitoring, alerting, dashboards, and operational analytics using platforms such as Datadog and Splunk.
• Maintain architecture diagrams, operational runbooks, implementation documentation, source-control practices, and engineering standards.

Skills:

• Deep expertise in IAM engineering, platform engineering, and identity integration within complex enterprise environments.
• Proficiency in implementing controls for non-human identities, including AI agents, service accounts, machine accounts, service principals, OAuth clients, workload identities, and associated credentials and certificates.
• Strong working knowledge of traditional workforce identity platforms, including SailPoint IdentityIQ, PingFederate, PingDirectory, Microsoft Entra, and Microsoft Active Directory.
• Familiarity with support, monitoring, and observability platforms such as ServiceNow, Datadog, and Splunk.
• Proven ability to design, implement, and debug identity lifecycle, authentication, federation, authorization, directory, and provisioning solutions.
• Experience building APIs, connectors, scripts, and automation for operational processing, monitoring, and audit or compliance use cases.
• Working knowledge of HRIS integrations, identity data models, SQL, ETL or data pipelines, logging, and reconciliation controls.
• Strong troubleshooting, documentation, communication, and cross-functional delivery skills.
• Hands-on experience with SailPoint Identity Security Cloud, Agentic Fabric, Entro, Ping Agent IAM Core, PingAuthorize, API or MCP gateways, or comparable non-human identity platforms is preferred.
• Experience with privileged access management platforms such as HashiCorp Vault and OneIdentity Safeguard is preferred.
• Experience with CI/CD, infrastructure as code, automated testing, Git-based workflows, and production support practices is preferred.

Experience:

• 10 + years of IAM engineering, platform engineering, or identity integration experience in complex enterprise environments.
• Demonstrated experience implementing controls for non-human identities such as AI agents, service accounts, machine accounts, service principals, OAuth clients, and workload identities.
• Experience implementing or transitioning identity services to SaaS and cloud delivery models.
• Hands-on experience with privileged access management platforms such as HashiCorp Vault and OneIdentity Safeguard is preferred.
• Experience with CI/CD pipelines, infrastructure as code, automated testing, and Git-based workflows is preferred.

Qualifications:

• Relevant SailPoint certifications are preferred.
• Relevant Ping Identity certifications are preferred.
• Relevant Microsoft certifications are preferred.
• Relevant cloud platform certifications are preferred.
• Relevant security certifications are preferred.

This is a rare opportunity to work at the intersection of enterprise identity and artificial intelligence, helping to shape and operationalize a discipline that is defining the future of security in AI-driven organizations. You will have the chance to work with some of the most advanced and emerging identity platforms available, tackle complex and intellectually stimulating engineering challenges, and make a direct, measurable impact on the security posture and operational resilience of a globally recognized enterprise. For the right candidate, this contract role also offers a clear pathway to a permanent position, making it an exceptional opportunity to build a long-term career at the cutting edge of identity and access management.

Pay Rate Range

63 - 72 USD hourly