Cybersecurity Engineer III, Identity and Access Management (IAM)

Job Description:

Who We Are

At Upbound Group, we are committed to elevating financial opportunity for all through innovative, inclusive, and technology-driven financial solutions that address the evolving needs and aspirations of consumers. The Company’s customer-facing operating units include industry-leading brands such as Rent-A-Center, Acima and Brigit that facilitate consumer transactions across a wide range of store-based and digital retail channels, including over 2,400 company-branded retail units across the United States, Mexico, New York and Puerto Rico. Upbound Group, Inc. is headquartered in Plano, Texas.

Role Summary

The Cybersecurity Engineer III, Identity and Access Management (IAM), is a hands-on engineer on Upbound’s IAM team who secures how coworkers, contractors, applications, and AI agents sign in and what they can reach. As part of an AI-native engineering organization, the engineer automates this work in code and with AI tools, working with Technology, HR, Security Operations, and Compliance.

Key Responsibilities

·         Manage Microsoft Entra ID tenant environments and workforce sign-in, including tenant architecture, Conditional Access policies, MFA, passkeys and other phishing-resistant/passwordless authentication (FIDO2, Windows Hello), Identity Protection, sign-in method registration, device-based access, and the retirement of older sign-in methods.

·         Own identity lifecycle automation and access governance. Automate user provisioning and deprovisioning via Entra ID, SCIM-based integrations, and custom pipelines; grant and change access for coworkers, contractors, and partners from HR records or approved requests and remove it when they leave; run access reviews, entitlement management, dynamic group policies, and Administrative Units that produce audit evidence. Keep the code tested, peer-reviewed, and secure, with secrets in a managed vault.

·         Connect applications to single sign-on and automated provisioning using SAML, OAuth 2.0, and OpenID Connect for SaaS and on-premises applications and manage app registrations and user consent.

·         Manage privileged access in Microsoft Entra ID and Azure, including approval-based just-in-time role activation, least-privilege admin roles, emergency access accounts, and reviews of who holds and uses admin rights.

·         Govern non-human identities, including service accounts, application identities, API keys, and AI agents. Give each an owner, only the access it needs, managed or rotated credentials, and a tested way to revoke its access.

·         Support hybrid identity environments, including Azure AD Connect / Cloud Sync, LDAP integrations, and federated-to-managed domain transitions.

·         Detect and respond to identity-related threats with Security Operations. Configure identity logging, security alerting, and continuous monitoring of sign-in and audit logs; choose the sign-in signals to monitor; investigate suspicious activity; and revoke sessions and access quickly when an account is compromised, including outside business hours.

·         Develop and maintain custom IAM provisioning code and internal platform services, using Go for backend services and React.js for frontend integrations with HRIS platforms, plus Bash, PowerShell, RegEx, Python, and SQL for broader automation, scripting, and database queries as needed.

·         Develop and maintain documentation, including runbooks, architecture diagrams, security standards, and operational procedures.

·         Evaluate emerging IAM technologies and AI tools, integrating AI-driven tools into daily engineering work to enhance decision-making and accelerate delivery, and recommending platform enhancements and modernization initiatives to leadership.

Required Qualifications

·         5+ years in cybersecurity, including at least 3 in identity and access management.

·         Hands-on Microsoft Entra ID experience, including Conditional Access, phishing-resistant authentication, Privileged Identity Management, and hybrid identity with Active Directory, plus SAML, OAuth 2.0, OpenID Connect, SCIM, and FIDO2.

·         Hands-on experience with Go (Golang) for building and maintaining production backend services, plus Python or PowerShell for automation, with source control, peer review, CI/CD, and infrastructure as code.

·         Experience with React.js for building and maintaining web-based administrative interfaces.

·         Practical use of AI tools in daily engineering work, such as access analysis, policy review, and investigations, with the judgment to check their output.

·         Clear writing and speaking that explains identity design and risk to engineers, auditors, and business leaders.

Preferred Qualifications

·         Experience integrating identity platforms with HR systems.

·         Experience securing workload and AI agent identities in Azure, AWS, or Google Cloud.

·         Experience managing and integrating PAM solutions into identity workflows.

·         Certifications such as SC-300, AZ-500, CISSP, or CCSP.

Work Location

Ability to work in the Plano, Texas, Monday through Friday, with travel between locations as needed.

Employment Eligibility

To be eligible for this opportunity, you must be authorized to work in the U.S. Upbound Group does not offer employment-based immigration sponsorship for this role, including OPT or CPT.

Equal Opportunity Employer

Upbound Group is an equal opportunity employer committed to ensuring all employment decisions are made on a non-discriminatory basis in accordance with applicable federal, state, and local laws.

Upbound Group is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees.