Lead Infrastructure Engineer (Identity)

University of Derby; East Midlands; On-site; GBP 65,000 - 90,000; Full time

Benefits offered by this job

Annual leave 38 days + bank holidays

Wellbeing benefits

Staff discounts

Onsite gym discount

Holiday purchase

Cycle to Work

Flexible working

Development opportunities

Job summary

University of Derby seeks a Lead Infrastructure Engineer (Identity) to drive the transformation of the University’s identity and access services. You’ll define and deliver the identity roadmap, moving from traditional on-premises AD to a modern Entra-first architecture, implementing Zero Trust, passwordless auth, and governance across cloud and hybrid environments.

You will collaborate with HR, Security and application teams to automate identity lifecycles, integrate with HR and student data

Qualifications

• Extensive experience delivering enterprise identity solutions in Microsoft cloud/hybrid environments.
• Experience modernising identity services towards Entra-first, Zero Trust models.
• Ability to lead identity projects and collaborate across HR, Security, and IT teams.
• Strong scripting and automation skills for identity workflows.

Responsibilities

• Lead and deliver the identity roadmap, moving from on-prem to cloud-native Entra-first architecture.
• Develop secure, resilient identity services with Zero Trust principles.
• Automate identity lifecycle management and governance workflows.
• Collaborate with HR, app owners and Service Delivery to modernise identities across the university.
• Provide technical leadership on Active Directory/Entra ID and related auth controls.

Skills

Identity & access management

Cloud automation

Zero Trust

Hybrid cloud

PowerShell scripting

Microsoft Entra ID

Azure AD governance

Problem solving

Education

BSc in Computer Science or related discipline

Tools

Microsoft Entra ID

Active Directory

Azure DevOps

Terraform

Ansible

PowerShell

Microsoft Graph API

Job description

Digital Solutions & Services are responsible for providing the digital platform to enable the best possible service to staff, students and stakeholders across the University and beyond. We take a collaborative approach to developing strategic goals to provide a diverse range of information technology and business services designed to support learning, teaching and research at the University of Derby.

Digital Solutions & Services are responsible for ensuring that the University’s IT capability is fit for purpose, future focused and able to protect, support and enhance the full breadth of services that will be delivered either on campus or digitally online with contributions across the department. We aim to assist students, teaching staff, support departments and collaborative partners to ensure we are making an impact on the University’s current and future digital landscape

About the Role

As Lead Infrastructure Engineer (Identity), you will take a leading technical role in transforming the University’s identity and access services, helping us move from traditional on-premises Active Directory and synchronisation-based identity towards a modern, cloud-native Microsoft Entra-first architecture.

You will help define and deliver our identity roadmap, developing secure and resilient services built around Zero Trust, passwordless authentication, identity governance and automated identity lifecycle management. Working with HR, Information Security, application owners and Service Delivery, you will help modernise how identities are created, managed, governed and secured across the University.

The role has a strong focus on Microsoft Entra ID and Entra ID Governance, Conditional Access, Privileged Identity Management, Microsoft Graph and automation, alongside the Azure and hybrid infrastructure that supports these services. You will also help develop API-based integration with authoritative HR and student identity sources, reducing manual processes and our dependency on legacy identity infrastructure.

This is a 2-year fixed-term transformation opportunity with the chance to make a significant and lasting impact on the University’s technology landscape. You will lead and support key projects that improve security, simplify the experience for students and staff, increase automation and establish the identity foundations needed to support the University’s future digital services.

About You

The ideal candidate will have significant experience of delivering and supporting enterprise identity solutions within Microsoft cloud and hybrid environments. You will have a passion for modernising identity services and a desire to take established, often complex identity processes and transform them into secure, automated and cloud-native services.

You will be comfortable taking technical leadership of identity solutions, helping shape our journey from traditional Active Directory and synchronisation-based identity towards an Entra-first, Zero Trust approach. You will combine strong technical knowledge with the ability to work across teams, solve complex problems and turn strategic direction into practical solutions that improve security and the experience of our students and staff.

You will bring a range of identity, cloud and automation skills such as (see job description for full role details):

Significant experience administering and engineering Microsoft Entra ID and Active Directory, including hybrid identity and directory synchronisation.

Strong knowledge of Conditional Access, authentication, Single Sign-On, role-based access control and privileged identity controls.

Experience of Entra ID Governance, including Access Reviews, Entitlement Management, Lifecycle Workflows and Privileged Identity Management (PIM).

Experience automating identity lifecycle and infrastructure services using PowerShell, Microsoft Graph APIs and workflows.

Experience designing and delivering secure, resilient and scalable solutions across Azure and hybrid Microsoft environments.

Experience integrating identity and access controls with applications, cloud services and authoritative data sources.

An understanding of Zero Trust, identity security, privileged access, audit and logging, together with a drive to automate and continually improve services.

Most importantly, we are looking for someone who wants to help shape what identity at the University looks like in the future, not simply maintain what we have today.

Generous annual leave entitlement of 38 days inclusive of bank holidays and concessionary days (pro rata)

Suite of holistic wellbeing benefits and support including family-friendly policies, generous sick pay provision and comprehensive Employee Assistance Programme

Access to a variety of staff discounts at high street retailers

Discounted onsite gym

Holiday purchase

Cycle to Work scheme

A flexible working environment

A commitment to personal and professional development

Key Contact

For further information and informal enquiries regarding the role, please contact Steve Smith, Cloud Infrastructure and Identity Manager via [e-mail]

For enquiries regarding your application and for sponsorship eligibility, please contact the recruitment team via [e-mail]

The University is unable to sponsor the employment of international workers under the Skilled Worker route for this role; however, applications are welcome from candidates who are able to demonstrate an alternative right to work in the UK.

Please visit our website for more information.

Essential CriteriaQualificationsBSc in Computer Science or a related discipline, or equivalent substantial professional experience in an identity, cloud or infrastructure engineering role.ExperienceSignificant experience of implementing innovative solutions that are customer and future focused, particularly using Azure Cloud technologies and Microsoft Entra Suite.Significant experience administering and engineering Microsoft Entra ID and Active Directory, including hybrid identity, directory synchronisation, enterprise applications, single sign-on, role-based access control, Conditional Access and privileged identity controls.Strong background in designing and delivering enterprise identity and hybrid cloud solutions, including identity architecture, directory services, automation, Azure DevOps and infrastructure-as-code or configuration-management approaches such as Terraform and Ansible.Experience of automating identity lifecycle and infrastructure services using PowerShell, Microsoft Graph API, workflows and infrastructure-as-code or configuration-management practices.Proven experience delivering in a high-performance multi-disciplinary infrastructure team.Demonstrated experience in modernising identity environments, including reducing on-premises Active Directory dependency and transitioning synchronization models towards Entra-first native cloud identities.Demonstrated proficiency with relevant programming / scripting and source code management.Demonstrated proficiency with command line and interactive shells.Proficient in using source control and Azure DevOps or equivalent CI/CD tooling to manage, test and deploy identity and infrastructure configuration safely and consistently.Experience designing, deploying and managing secure, resilient and scalable solutions across Azure and hybrid Microsoft environments.Experience integrating identity and access controls with applications, cloud services and supporting infrastructure technologies.Demonstrated proficiency in Microsoft Entra ID, Azure, Microsoft 365 and hybrid identity services, including directory synchronisation, enterprise applications, access controls, conditional access and authentication methods.Skills, knowledge & abilitiesStrong configuration, secrets and change-management practices for identity and infrastructure services.Knowledge of application delivery and network services, for example, DNS, DHCP and IP address management.Understanding of project management lifecycle from conception through implementation.In-depth technical knowledge of Microsoft Entra ID and Governance, Active Directory, authentication and authorisation, identity lifecycle management, Windows Server and related application infrastructure technologies.Business requirementsWork as part of an on call out of hours rota.Desirable CriteriaQualificationsRelevant industry technical certification, for example Microsoft Certified: Identity and Access Administrator Associate, Cybersecurity Architect Expert or Azure Administrator Associate.ITIL FoundationExperienceExperience of configuration-management and development lifecycles. Familiarity with DevOps practices and automation using Ansible, Azure DevOps or equivalent tooling is desirable.Integration of cloud services with on-premises infrastructureProven experience of developing technical strategies and policies in line with business requirementsPrevious experience within a Higher Education InstitutionExperience of managing support contracts, ensuring vendors are compliant with their SLAs.Experience supporting core infrastructure platforms such as Hyper-V or Azure Stack HCI.Skills, knowledge, and abilitiesUnderstanding of information security best practice as it applies to identity, authentication, privileged access, audit, logging and hybrid cloud infrastructure.Understanding of configuration management tools and techniques as part of application and infrastructureKnowledge of container technologies such as Docker, Kubernetes or OpenShift and their identity and access integration requirements.Strong orchestration, scripting and automation experience using technologies such as PowerShell, Microsoft Graph, APIs, Azure DevOps, Ansible or Terraform.Knowledge of Windows Server and Red Hat Operating Systems.Understanding of procurement regulations, guidelines, and procedures such as tender processes and IT public sector frameworks