Privileged Access & Identity Security Architect - Entra ID

Neurealm; Pune District, Chennai, Bengaluru; On-site; INR 1,500,000 - 2,600,000; Full time

Job summary

Neurealm Company is seeking an experienced IAM/identity security leader to own privileged access design and governance across a hybrid Microsoft estate. As policy owner, you will define PIM, CA, and zero-trust controls, guiding platform teams to implementation and reviews.

You will drive enterprise-scale identity policy, enforcement, and incident response, reporting on risk and control health with a focus on ISO 27001 and DPDP requirements.

Qualifications

• Deep expertise in IAM/security and Entra ID with AD security focus.
• Experience designing PIM, CA and access reviews at enterprise scale.
• Knowledge of identity attacks and controls to mitigate them.
• Hybrid identity architecture including Entra Connect/Cloud Sync and Tier 0.
• Ability to author identity policies and drive adoption with IT/business teams.
• Strong documentation and stakeholder communication skills.

Responsibilities

• Privileged access architecture: design and own the model across Entra ID and on-prem AD.
• Identity controls and zero trust: define CA policies, phishing-resistant MFA, risk responses.
• Non-human/workload identities: govern service principals, app registrations and secrets rotation.
• Identity governance: run access reviews, entitlement management and lifecycle workflows.
• Incident support: act as identity expert during incidents and drive fixes.
• Maintain security policies aligned with ISO 27001/DPDP and audits.

Skills

IAM security

Entra ID

Active Directory

PIM

Conditional Access

Access reviews

Hybrid identity

Documentation

Stakeholder communication

Tools

Entra Connect

Cloud Sync

PowerShell

Microsoft Graph

Job description

Role summary

You will own how identity and privileged access are designed and governed across a hybrid Microsoft estate. As part of a zero-trust program, and building on lessons from recent identity incidents, you will define a tightened privileged access model in Entra ID and on-prem AD, set the policies and standards, and hold teams to them through reviews and governance. You are the policy owner and design authority; platform teams implement and operate under your direction.

Key responsibilities:

Privileged access architecture

• Design and own the privileged access model based on Microsoft's Enterprise Access Model (control, management and user/workload planes), covering Entra ID and on-prem AD.
• Define standards for Privileged Identity Management (PIM): just-in-time, time-bound elevation, approval workflows, justification, MFA on activation, and PIM for Groups.
• Minimize standing privilege: remove permanent Global Administrator and other high-impact role assignments, apply least-privilege and custom roles, and use administrative units and restricted management where suitable.
• Define emergency access (break-glass) accounts, privileged access workstation requirements and secure admin pathways.

Identity controls and zero trust

• Design the Conditional Access framework: baseline policies, admin-specific policies, device compliance, location and risk conditions, authentication strengths and session controls.
• Drive phishing-resistant authentication (FIDO2 keys, passkeys, Windows Hello for Business, certificate-based authentication) for all privileged users.
• Use Entra ID Protection user and sign-in risk signals, and define responses to risky identities.
• Govern hybrid identity: Entra Connect / Cloud Sync security, AD tiering, Tier 0 protection and hardening against common AD attacks.

Non-human and workload identities

• Set policy for service principals, managed identities, app registrations and enterprise apps: ownership, credential hygiene, secret and certificate rotation, and workload identity federation in place of secrets.
• Control application consent and high-privilege API permissions (for example, Microsoft Graph) to block consent phishing and over-privileged apps.
• Govern on-prem service accounts and group Managed Service Accounts.

Identity governance and review policies

• Design and run access reviews for privileged roles, groups, guest users and applications, with clear reviewers, cadence and auto-remediation.
• Define joiner-mover-leaver controls with Entra ID Governance (entitlement management, access packages, lifecycle workflows).
• Maintain identity security policies, standards and exceptions; align with ISO 27001, DPDP Act and healthcare/GxP audit requirements.
• Report identity risk and control health: standing privilege counts, PIM adoption, phishing-resistant MFA coverage, review completion and stale accounts.

Incident support

• Act as identity expert in incidents involving compromised accounts, token theft, privilege escalation or malicious consent, and lead the identity root cause and control fixes.

Must-have skills

• 10+ years in IAM/identity security, with deep Entra ID and Active Directory security expertise.
• Proven design and rollout of PIM, Conditional Access and access reviews at enterprise scale.
• Strong understanding of identity attacks (AiTM phishing, token replay, consent phishing, Kerberos attacks, DCSync) and the controls that stop them.
• Hybrid identity architecture: Entra Connect / Cloud Sync, AD tiering and Tier 0 protection.
• Experience writing identity policies and standards and winning adoption from IT and business teams.
• Strong documentation and stakeholder communication.

Good to have

• Entra ID Governance (entitlement management, lifecycle workflows) and Entra ID Protection in production.
• Identity threat detection tooling (for example, CrowdStrike Falcon Identity Protection or Microsoft Defender for Identity).
• Automation with Microsoft Graph and PowerShell for identity reporting.
• Experience in regulated industries, ideally healthcare or pharma.
• Certifications: SC-300, SC-100, AZ-500, CISSP, or equivalent.
• Looking for Immediate Joiners

What success looks like in 12 months

• No permanent Global Administrators outside break-glass accounts; all privileged roles eligible through PIM.
• 100% of privileged users on phishing-resistant authentication.
• Quarterly access reviews running for all privileged roles, with completion tracked.
• Workload identities inventoried, owned, and moved off long-lived secrets where possible.