Identity Operations Engineer

About the role

We are UMG, the Universal Music Group. We are the world's leading music company. In everything we do, we are committed to artistry, innovation and entrepreneurship. We own and operate a broad array of businesses engaged in recorded music, music publishing, merchandising, and audiovisual content in more than 60 countries. We identify and develop recording artists and songwriters, and we produce, distribute and promote the most critically acclaimed and commercially successful music to delight and entertain fans around the world.

Job Summary

As a key member of the UMG Operations Center, the Identity Operations Engineer operates and continuously improves UMG's hybrid identity, access, authentication, privileged-access, and identity-governance services. The role provides specialist operational support across Workday-driven identity lifecycle processes, Saviynt/IGA, Active Directory, Microsoft Entra ID, Microsoft 365, MFA, PAM, enterprise application integrations, and connected services.

The position will be a team player working to maintain reliable identity integrations and resolve operational issues involving joiners, movers, leavers, contractors, rejoiners, application access, entitlements, authentication, privileged accounts, and non-human identities. The role includes incident, request, change, problem, access-review, audit-evidence, monitoring, and automation activities.

The role partners closely with Engineering, Architecture, Cloud, Observability, ITSM, security, regional IT teams, and external providers. Effective communication skills are a must, all while being sensitive to a wide diversity of cultural and technical backgrounds in a global business environment.

Job Functions

• Apply least-privilege, segregation-of-duties, secure administration, and identity-governance best practices to protect UMG information resources from unauthorized use, inappropriate access, disclosure, damage, or loss.
• Troubleshoot and resolves issues related to identities, systems, access, accounts, authentication, authorization, entitlements, and permissions.
• Investigate and resolve specialist escalations from AD Services and TechOps IAM queues, including application-role access, SecAdmin access, reference-user comparisons, disabled application accounts, access removals, and entitlement issues.
• Provide ITIL-based operational support across identity services, including incident, request, change, problem, and major-incident participation. Maintain clear ServiceNow assignment, evidence, troubleshooting notes, resolution details, and closure criteria.
• Operate and troubleshoot identity lifecycle integrations, including joiner, mover, leaver, contractor, rehire/rejoiner, and exception scenarios. Investigate failed provisioning tasks, reconciliation issues, orphaned accounts, and mismatches between authoritative HR data, IGA records, directories, and target applications.
• Support Workday-driven lifecycle processes and Saviynt/IGA workflows, including access requests, approvals, entitlement ownership, access reviews, remediation, audit evidence, and provisioning/reconciliation failures.
• Operate and support on-premises and cloud identity services and their configuration, including Active Directory domain services, Microsoft Entra ID, Microsoft 365, Duo, YubiKey/FIDO/PIV authentication, CyberArk/PAM, Saviynt/IGA, Splunk, Active Roles where applicable, PingOne/Aura where applicable, 1Password, HashiCorp Vault, and connected enterprise applications.
• Troubleshoot Microsoft Entra enterprise applications and federation integrations, including SAML, OIDC/OAuth, claims, redirect URIs, app registrations, group assignments, Conditional Access, Microsoft Graph, certificates, and token/authentication failures.
• Support privileged and non-human identities, including elevated accounts, service accounts, application accounts, RPA accounts, resource/test accounts, B2B/guest identities, and accounts requiring vault onboarding, password rotation, or ownership validation.
• Support MFA and authentication operations, including Duo, YubiKey, FIDO/PIV, recovery/reset workflows, OAuth-token issues, and authentication failures across workforce and application services.
• Complete the key metric reporting and analysis for the Identity Management environment as required.
• Work to ensure audit tasks related to Identity Management are completed on time, with participation of appropriate parties. Maintain auditable evidence for access approvals, reviews, privileged access, lifecycle actions, exceptions, and remediation.
• Participate in security incident response teams as needed, including identity compromise, suspicious authentication, privileged-access, credential, and account-containment activities.
• Utilize industry best practices for appropriate standards, processes, procedures, tools, and documentation.
• Ensure the maintenance, patching, operating, and monitoring of IAM systems is in place and completed on schedule. Use Splunk and observability service dashboards to identify failures, trends, and emerging operational risk.
• Maintain accurate ServiceNow CMDB relationships for identity services, configuration items, application integrations, owners, support groups, and dependencies; identify and report stale or incomplete CMDB data.
• Participate in developing automation to reduce the time spent on routine tasks.
• This is a shift-based role supporting UMG's 24/7 follow-the-sun Technical Operations Center. The role participates in scheduled shifts, weekend/public-holiday coverage, on-call rotation, and structured handoffs with regional operations teams

Essential

• Solid technical skills in the Identity Management space, including Active Directory and Entra ID.
• Minimum of five years directly related experience in Identity & Access Management (IAM)
• A strong ability for troubleshooting and problem analysis is required, along with the ability to clearly communicate the results of problem analysis to business stakeholders, IT support teams, and network providers to quickly and effectively resolve operational issues.
• Experience troubleshooting and solving issues related to identities, systems, access, accounts, authentication, authorization, entitlements, and permissions
• Hands-on experience operating and supporting Active Directory and Entra ID, including directory services, delegated administration, group policy, OUs, sites/replication, identity synchronization, enterprise applications, federation, Conditional Access, and authentication.
• Hands-on experience with Saviynt or another IGA platform, including access requests, approvals, entitlement administration, access reviews, failed-task remediation, reconciliation, and audit evidence.
• Experience with identity lifecycle integrations from an authoritative HR source such as Workday, including joiner/mover/leaver, contractor, rehire, and exception handling.
• Customer service driven/focused with a proactive and positive can-do approach. Demonstrates commitment to organization's policy framework and practices continuous improvement.
• Hands-on experience and skills with systems such as M365 and ServiceNow are required. Experience using ServiceNow for IAM incidents, requests, changes, knowledge, evidence, assignment groups, and CMDB relationships is required.
• Demonstrated current work experience supporting integrated IAM solutions such as Entra ID, Active Roles where applicable, Duo, PKI, and CyberArk/PAM
• Working knowledge of site-reliability/operational-engineering principles, monitoring, automation, and safe use of AI-assisted tools.
• Demonstrated organizational skills, attention to detail and ability to work both independently and as part of a team.
• Solid written, oral, and interpersonal communications skills

Desirable

• Bachelor's degree in computer science, engineering, a closely related field, or comparable education and experience.
• Experience with at least two of the following is desirable: PingOne/Aura, 1Password, HashiCorp Vault, Microsoft Graph, SAML/OIDC/OAuth, enterprise application onboarding, or secrets/service-account rotation.
• Experience integrating or troubleshooting ServiceNow orchestration with identity platforms, directories, SaaS applications, or enterprise applications is desirable.
• Understanding of Microsoft 365 identity, group, collaboration, and federation dependencies.
• Experience using PowerShell, Python, JSON/REST, Microsoft Graph, SQL, or comparable scripting/API technologies for IAM automation and troubleshooting. Legacy Java, SOAP, or database experience
• IT Certifications including MCSE Certification specialization in Identity Management, Certified Access Management Specialist (CAMS), and ITIL Foundations certifications desired
• International experience beneficial; multiple language skills a plus

Perks Playlist

Join an entrepreneurial, global organization where authenticity, boldness, creativity, connection, drive, and insight aren't just values-they're how we work every day. Here are some of the ways we support you along the way (and just a few of the benefits we offer):

• Comprehensive medical, dental, and vision coverage
• Including 100% coverage for out-patient in-network mental health services
• Fertility coverage for eligible medical plan participants
• Wellbeing reimbursements for fitness classes, spa treatments, meal services, travel, and so much more (up to $720/year)
• Student Loan Repayment Assistance and Tuition Reimbursement
• 401(k) with 100% immediate vesting on the first 5% of your contributions, plus an additional UMG contribution

A variety of ways to prioritize much-needed time away from work including:

• Flexible Paid Time Off (PTO) for exempt employees
• 3-weeks PTO for non-exempt employees
• 2-weeks paid Winter Break
• 10 Company Holidays (including Juneteenth and Wellbeing Day)
• Summer Fridays (between Memorial Day and Labor Day)
• Generous paid parental leave for every type of parent

Check out our full overview of benefits on the Perks Playlist page of the career site.

Salary Range

$75.305 - $100,000

The actual base salary offered depends on a variety of factors, which may include, as applicable, the qualifications of the individual applicant for the position, years of relevant experience, specific and unique skills, level of education attained, certifications or other professional licenses held, and the location in which the applicant lives and/or from which they will be performing the job. All candidates are encouraged to apply.