Job Summary
The IAM Solutions Architect - Microsoft Entra ID is responsible for designing, implementing, and maintaining enterprise Identity and Access Management (IAM) architectures using Microsoft Entra ID and Active Directory. The role focuses on identity strategy, hybrid identity, Zero Trust principles, identity governance, privileged access management, and regulatory compliance. This position provides architectural leadership across cloud migrations, modernization initiatives, and enterprise security programs while ensuring secure, scalable, auditable, and automated identity solutions.
Key Responsibilities
• Design, implement, and maintain end-to-end Identity and Access Management architectures using Microsoft Entra ID and Active Directory.
• Establish a long-term identity strategy aligned with business, security, and regulatory requirements.
• Architect secure hybrid identity models, including Entra Connect, cloud synchronization strategies, and identity lifecycle automation.
• Drive the adoption of Zero Trust identity principles, including continuous evaluation and least-privilege access.
• Lead the design and optimization of Conditional Access policies, authentication flows, multifactor authentication (MFA), passwordless strategies such as FIDO2 and Windows Hello for Business, and identity protection.
• Architect, standardize, and provide governance oversight for Entra ID Governance capabilities, including Privileged Identity Management (PIM), access reviews, entitlement management, custom roles, and segregation of duties.
• Oversee the configuration of Entra applications, service principals, federations, SCIM provisioning, and single sign-on (SSO) integrations using SAML, OIDC, and OAuth2.
• Design secure, resilient, and scalable Active Directory forests, domains, Group Policy Object (GPO) structures, and privileged access boundaries.
• Lead initiatives to modernize Active Directory security, including tiered administration models, privileged access isolation, ESAE cleanup, delegated administration, and secure baselines.
• Implement Active Directory hardening, lifecycle management, group governance, and remediation of legacy dependencies.
• Develop identity standards, design patterns, security baselines, and governance frameworks.
• Ensure compliance with regulatory requirements, including SOX, HIPAA, GDPR, ISO 27001, and internal audit controls.
• Provide guidance on role-based access control (RBAC) and attribute-based access control (ABAC) models, identity lifecycle management, privileged access governance, and application onboarding.
• Design identity controls that are auditable, measurable, and automatable to support internal risk assessments and regulatory compliance.
• Collaborate with cloud platform and DevSecOps teams to integrate identity controls into cloud landing zones, CI/CD pipelines, and enterprise architectures.
• Partner with security operations teams to integrate identity telemetry, threat detection, and incident response workflows.
• Work closely with Security Engineering, Application Owners, Cloud Platform Engineering and Architecture, and Infrastructure teams.
• Provide architectural direction for acquisition integration, cloud migrations, and modernization projects.
• Develop architecture diagrams, roadmaps, threat models, and solution documentation.
• Drive IAM as a shared enterprise platform while balancing security, user experience, and operational resilience.
• Stay current with identity trends, Microsoft Entra roadmap updates, and emerging threats.
• Recommend continuous improvements across authentication, authorization, and identity governance.
• Mentor engineers and promote best practices in identity design and operations.
Required Qualifications
• 8+ years of experience in Identity and Access Management architecture or engineering.
• Deep expertise in Microsoft Entra ID (Azure AD), Conditional Access, Identity Protection, and Entra ID Governance.
• Strong knowledge of Active Directory design, replication, DNS, GPO, PKI, and delegation models.
• Expertise in SSO protocols, including OAuth2, OIDC, SAML, and WS-Federation.
• Experience with identity lifecycle automation and provisioning.
• Strong understanding of Zero Trust architecture principles.
• Strong knowledge of MFA, passwordless authentication, risk-based policies, and authentication flows.
• Experience securing hybrid identity environments using Entra Connect, federation services, and cloud-only identity patterns.
• Expertise in building Terraform Infrastructure as Code (IaC) resources and guardrails for identity services using reusable modules and automated CI/CD pipelines.
• Proficiency in PowerShell or other automation frameworks.
• Strong understanding of IAM risk management, audit requirements, and regulatory standards.
• Exceptional communication and leadership skills.
• Ability to work across organizational boundaries with technical and executive stakeholders.
• Strong problem-solving, decision-making, and strategic thinking skills.
• Ability to simplify complex identity concepts into actionable guidance.
Preferred Qualifications
• Microsoft certifications such as SC-300, SC-100, AZ-305, or equivalent.
• Experience with Privileged Access Workstations (PAW).
• Experience with Microsoft Identity Manager (MIM) or other Identity Lifecycle Management (ILM) solutions.
• Experience with advanced Conditional Access configurations and automation.
• Experience with enterprise-scale identity consolidation and domain migration projects.
• Familiarity with modern IAM platforms such as SailPoint, CyberArk, and Okta.
• Background in security architecture, threat modeling, or penetration testing related to identity systems.
