This role will provide technical leadership for enterprise identity architecture, authentication, access governance, privileged access, and Microsoft identity platform strategy.

This role will serve as a senior engineering leader responsible for defining the future-state architecture for workforce identity, privileged access, access governance, and Zero Trust initiatives across the Microsoft ecosystem. The Principal Engineer will partner closely with Cybersecurity, Infrastructure Engineering, Application Development, Risk, and Architecture teams to deliver secure, scalable, and resilient identity solutions supporting enterprise business and regulatory requirements.

In this role, you will:

• Serve as a principal technical advisor for enterprise identity architecture, authentication, authorization, federation, access governance, and privileged access management initiatives.
• Lead the design and adoption of enterprise identity solutions leveraging Microsoft Entra ID, Active Directory, Privileged Identity Management (PIM), Conditional Access, and related identity technologies.
• Define IAM reference architectures, engineering standards, roadmaps, and reusable patterns supporting enterprise-scale identity services.
• Provide technical leadership for Zero Trust strategies, Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), privileged access, and identity governance programs.
• Lead the evaluation, design, and implementation of secure authentication and authorization services supporting cloud, on-premises, and hybrid environments.
• Drive adoption of modern identity capabilities including passwordless authentication, federation, adaptive access controls, lifecycle management, and privileged access controls.
• Collaborate with Cybersecurity, Infrastructure, Product, Risk, and Application teams to assess identity-related risks and develop secure engineering solutions.
• Lead architecture reviews, threat modeling exercises, technology assessments, and engineering design decisions for strategic IAM initiatives.
• Develop standards and best practices for identity governance, access certifications, entitlement management, privileged access, and identity lifecycle management.
• Evaluate emerging technologies and industry trends to influence enterprise identity strategy and improve security posture.
• Mentor engineers and architects while serving as a subject matter expert across IAM and identity security domains.
• Communicate technical strategy, architecture direction, and risk considerations to senior leadership and stakeholders across the enterprise.
• Demonstrate proficiency in using AIassisted development and analysis tools (e.g., GitHub Copilot and approved codecentric agents)
• Leverage AI to accelerate system design, coding, testing, analysis, and troubleshooting
• Apply strong technical judgment when validating and integrating AIassisted outputs into solutions
• Understand and account for model limitations, security risks, and operational considerations
• Apply AI responsibly in development and production environments
• Ensure AI usage aligns with security, compliance, privacy, and ethical standards

Required Qualifications:

• 7+ years of Engineering experience, or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, education.
• 7+ years of experience designing and implementing enterprise Identity and Access Management solutions.

Desired Qualifications:

• Deep expertise in Microsoft Entra ID (Azure AD), Active Directory, Conditional Access, Privileged Identity Management (PIM), Identity Governance, and Access Reviews.
• Experience defining and governing Agentic AI and Agent365 platforms, including AI agent lifecycle management, security controls, identity integration, privileged access governance, risk management, policy enforcement, audit readiness, regulatory compliance, and human-in-the-loop oversight for enterprise AI deployments.
• Experience designing enterprise authentication and federation solutions leveraging SAML, OAuth 2.0, OpenID Connect (OIDC), Kerberos, and SCIM.
• Experience with identity governance, entitlement management, access certifications, joiner/mover/leaver processes, and role lifecycle management.
• Experience implementing passwordless authentication, phishing-resistant MFA, and modern access management solutions.
• Strong knowledge of Zero Trust architecture, RBAC, ABAC, least-privilege access, and privileged access management.
• Experience leading enterprise identity architecture and engineering initiatives within large-scale organizations.
• Experience with authentication, authorization, federation, and access management technologies.
• Experience defining engineering standards, technical roadmaps, and enterprise architecture strategies.
• Experience collaborating across Cybersecurity, Infrastructure, Risk, and Architecture organizations to deliver complex technical solutions.
• Experience integrating enterprise applications with Microsoft identity services and cloud-based access management platforms.
• Experience implementing automation and Identity-as-Code using PowerShell, APIs, Terraform, or related technologies.
• Experience supporting regulated environments and security frameworks including SOX, FFIEC, NIST, PCI-DSS, or similar standards.
• Industry certifications such as Microsoft Certified: Identity and Access Administrator Associate, Microsoft Cybersecurity Architect Expert, CISSP, CCSP, SABSA, TOGAF, or equivalent.
• Strong leadership, stakeholder management, and executive communication skills.

Locations:

• 150 E 42nd Street, New York, NY 10017

Posting Statements:

• Job posting may come down early due to volume of applicants.

• Required location(s) listed above. Relocation assistance is not available for this position

• Salary range is determined by location of the job. May be considered for a discretionary bonus, Restricted Share Rights, or other long term incentive awards.

• This position is not eligible for visa sponsorship

• This role is NOT available for 100% remote work

Pay Range

Reflected is the base pay range offered for this position. Pay may vary depending on factors including but not limited to demonstrated examples of prior performance, skills, experience, or work location. Employees may also be eligible for incentive opportunities.

Posting End Date:

*Job posting may come down early due to volume of applicants.