Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 14 hours ago

Senior IAM Engineer

Kidde Global Solutions190 open roles

Where
São Paulo, Brazil
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSenior IAM EngineerKidde Global Solutions · São Paulo, Brazil

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Kidde Global Solutions's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.7% of postings close within 7 days. Measured by our own scanner across the market. Kidde Global Solutions postings stay open a median of 20 days.

Share of postings closed within
  1. 2.3%1 day
  2. 4.8%3 days
  3. 13.7%7 days
  4. 22.1%14 days
  5. 37.6%30 days
  6. 59.1%60 days
This job: posted 14 hours ago

Kidde Global Solutions median: 20 days open

The posting

Role Purpose This role exists to serve as KGS’s senior in-house engineer for enterprise identity platforms, including Saviynt Identity Governance & Administration (IGA), Saviynt Privileged Access Management (PAM), single sign-on (SSO), and Customer Identity & Access Management (CIAM). The role owns Level 2 through Level 4 engineering work across design, configuration, integration, automation, and complex escalation, while the managed service provider continues to deliver Level 1 operations. Based in Brazil, the role extends IAM coverage across the Americas and EMEA and provides trained backup for Active Directory, Microsoft Entra ID, and Microsoft 365 identity services. The role partners with the Senior Manager, Identity & Cloud Security, GRC, Infrastructure & Operations, HR, application owners, and service providers to strengthen identity governance, reduce operational risk, and improve automation and service resilience. Role Accountabilities This outlines the typical and expected accountabilities for this role:

Identity Governance & Administration: Onboard applications into Saviynt; build and maintain connectors, forms, workflows, request catalogs, and joiner-mover-leaver rules; and resolve synchronization issues between Dayforce and downstream systems. Access Certifications: Design and run User Access Review (UAR) and Privileged Access Review (PAR) campaigns, including advanced configuration for SOX-scoped and critical applications, and produce audit-ready evidence. Privileged Access Management: Administer the privileged-access vault and own service-account discovery, server onboarding, credential governance, AWS and Azure landing-zone integration, onboarding automation, and orphaned-account remediation. Customer & External Identity: Design, build, and operate CIAM capabilities for customers, partners, and other external users, including registration, authentication, federation, consent, and lifecycle governance. SSO & Modern Authentication: Onboard applications using SAML, OIDC, OAuth, and related provisioning standards; support retirement of legacy authentication; and apply established SSO governance and reporting standards. Automation & Reporting: Automate identity lifecycle and operational tasks and develop dashboards and metrics using PowerShell, Microsoft Graph, REST APIs, and related tooling. Identity Platform Coverage: Serve as trained backup for Active Directory and Microsoft Entra ID capabilities, including Conditional Access, PIM, Group Policy, PKI, and Microsoft 365 identity controls. Incident Response & On-Call: Participate in the identity on-call rotation and lead triage, root-cause analysis, and remediation for complex identity incidents. Operations & Managed Services: Provide Level 2–Level 4 identity support, act as the escalation point for the managed service provider, review Level 1 service quality, and maintain runbooks and knowledge transfer to reduce key-person dependency. Risk, Audit & Continuous Improvement: Support SOX, ISO 27001, and NIST-aligned controls; remediate audit findings; maintain control evidence; and identify opportunities to improve reliability, security, self-service, and user experience.

Role Competencies Core Competencies These are critical and fundamental to perform the role:

Identity engineering: Deep hands-on expertise in IGA, PAM, SSO, federation, authentication, and identity lifecycle management at enterprise scale. Technical problem solving: Diagnosing complex integrations, synchronization failures, access issues, and platform defects through structured analysis and root-cause remediation. Automation and improvement: Using scripting, APIs, reusable patterns, and self-service to reduce manual effort and improve control consistency. Risk and compliance: Translating SOX, ISO 27001, and NIST-aligned requirements into sustainable identity controls and audit-ready evidence. Operational ownership: Managing escalations, incidents, changes, documentation, and service-provider handoffs with urgency and accountability. Collaboration and communication: Working effectively with global technical teams, business stakeholders, auditors, and external partners in English and Portuguese.

Qualifications (Education, Experience, Technical Knowledge) Key qualifications relevant to this role:

Bachelor’s degree in Computer Science, Information Systems, or a related field, or equivalent experience. 8+ years of Identity & Access Management experience, including 3+ years of hands-on engineering experience with Saviynt or a comparable IGA/PAM platform. Demonstrable experience building connectors, workflows, request processes, and application onboarding in an enterprise IGA platform. Hands-on CIAM experience with Microsoft Entra External ID, Azure AD B2C, Okta/Auth0, Ping, or a comparable platform. Strong PAM knowledge, including vaulting, credential rotation, service-account governance, privileged onboarding, and session management. Working knowledge of Microsoft Entra ID, Active Directory, Conditional Access, PIM, Group Policy, PKI, and SAML/OIDC/OAuth protocols. Automation skills using PowerShell, REST APIs, Microsoft Graph, or comparable technologies. Experience supporting SOX and/or ISO 27001 audits and producing control evidence. Fluency in English and Portuguese and willingness to participate in identity incident on-call support. Saviynt IGA/PAM certification and Microsoft SC-300 are preferred; CISSP, CISM, or CIAM-related certifications are beneficial. Experience working with global teams, managed service providers, and distributed stakeholders is preferred.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Kidde Global Solutions's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Kidde Global Solutions's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Kidde Global Solutions's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.