Identity Access Management Lead

Morgan McKinley; Sydney; Hybrid; AUD 150,000 - 170,000; Full time

Job summary

Morgan McKinley is seeking an Identity & Access Management Lead in Sydney CBD (Melbourne considered) for a permanent hybrid role. The successful candidate will own the entire IAM program, govern sign-in and policy, and guide the cloud, on-prem, and future AI identity roadmap.

You will oversee Entra ID, AD, M365, and Azure access, drive least-privilege controls with CyberArk, and mentor a team to raise security and governance standards across hybrid environments.

Qualifications

• 7+ years in identity or security-heavy infrastructure with recent lead/ senior engineering experience.
• Hands-on Entra ID and Azure access troubleshooting with root-cause analysis.
• Production experience with ADCS and certificate lifecycles.
• Administration of an enterprise PAM platform, CyberArk preferred.
• Ability to explain identity risk to engineers and senior leaders; mentoring mindset.

Responsibilities

• Run and improve a Microsoft-centred identity estate (Entra ID, on-prem AD, hybrid sync, M365, Azure access).
• Manage Conditional Access, MFA and sign-in policies; retire legacy authentication.
• Oversee AD administrative tiering, credential isolation and high-privilege protection.
• Administer enterprise PKI (ADCS) and certificate lifecycle hygiene.
• Lead the privileged access platform (CyberArk) with least-privilege controls.
• Design Azure role structure, access reviews and entitlement governance.
• Connect SaaS and internal apps via SAML, OIDC/OAuth and SCIM.
• Set standards for service principals, managed identities, app registrations and secrets.
• Automate with PowerShell, Microsoft Graph and Bicep/ARM.
• Act as escalation point for tricky sign-in, token and provisioning faults.

Skills

Entra ID

Azure AD

MFA

SAML

OIDC

SCIM

PowerShell

CyberArk

Kerberos

Active Directory

Tools

PowerShell

Microsoft Graph

Bicep/ARM

ADCS

Job description

Identity & Access Management Lead

Sydney CBD (Melbourne considered)

Permanent / Hyrbid

$150-170k base

We are working with a highly regarded professional service client who are looing to build out their IAM practice. Most identity engineers own a slice of the platform. This role owns the whole thing. It is a brand new lead position, set up because the organisation wants one person who is accountable for how people, systems and, before long, AI agents authenticate and what they are allowed to touch.

The target-state design already exists. What is needed now is someone hands-on to run identity as a reliable, well-governed service and to keep raising the bar as more workloads shift to cloud and SaaS and the on-premises footprint shrinks.

What you will be responsible for

• Running and improving a Microsoft-centred identity estate: Entra ID, on-prem AD, hybrid sync, M365 and Azure access
• Conditional Access, MFA and sign-in policy, including retiring legacy authentication
• AD administrative tiering, credential isolation and protection of the highest-privilege accounts
• Enterprise certificate services (ADCS and cloud PKI) and certificate lifecycle hygiene
• The privileged access platform (CyberArk) and least-privilege controls
• Azure role design, access reviews and entitlement governance
• Connecting SaaS and internal apps via SAML, OIDC/OAuth and SCIM
• Standards for service principals, managed identities, app registrations and secrets
• Automating with PowerShell, Microsoft Graph and Bicep/ARM
• Being the escalation point for tricky sign-in, token and provisioning faults

What you bring

• 7+ years in identity, or a security-heavy infrastructure career, with recent time as the senior or lead engineer
• Deep, hands-on Entra ID and Azure access troubleshooting with genuine root cause analysis
• Tiering and credential isolation you have actually implemented, not just designed
• Production experience running ADCS and managing certificate lifecycles
• Administration of an enterprise PAM platform, CyberArk preferred
• Confidence with Kerberos, SAML, OAuth/OIDC, tokens and claims
• Experience supporting audits and access certification
• The ability to explain identity risk to engineers and senior non-technical leaders alike
• Genuine enjoyment of mentoring and lifting a team

Why it is worth a conversation

• A newly created role with real authority over identity decisions
• Strategy already set, so you get straight to building and improving
• Modern Microsoft stack, cloud migration and AI agent identity on the roadmap
• High standards and a strong culture of learning and development