LEAD IT SPECIALIST - SR. IT SPECIALIST - Cloud Identity, PKI, and AI Specialist

Southwest Research Institute; San Antonio (TX); On-site; USD 120,000 - 180,000; Full time

Job summary

Southwest Research Institute in San Antonio, TX seeks an experienced Identity and Access Management specialist to design and maintain Entra ID (Azure AD), ADFS, PKI, and certificate lifecycle across Azure and AWS platforms.

You will implement secure access patterns, manage app registrations and RBAC, and collaborate with IT teams to resolve complex identity issues while documenting architectures for audits and governance.

Qualifications

• Bachelor's degree in IT or related field; 10 years' equivalent experience.
• Microsoft certifications preferred.
• 6 years hands-on experience managing enterprise identity platforms, including Active Directory, Entra ID, and CA/PKI.
• 3 years managing PKI and certificate lifecycle, including internal CA, OCSP/CRL, and templates.
• Experience designing and securing access for Azure and AWS solutions (Azure OpenAI, Azure AI Hub/Foundry, Cognitive Services; AWS Bedrock).

Responsibilities

• Design and secure access patterns for Azure and AWS identities and resources.
• Maintain Entra ID app registrations, service principals, and RBAC models.
• Collaborate with IT teams to resolve AD/Entra ID authentication issues and ensure governance.

Skills

PKI

ADFS

Active Directory

Entra ID

RBAC

Conditional Access

Education

Bachelor's degree in IT

Related certifications

Tools

Keyfactor Command

Job description

Who We Are:

Our team, the Cloud Services team within the Information Technology Center, is responsible for EntraID (formerly Azure)/M365 cloud services and Active Directory for the Enterprise. The team provides support and implementation services to the entire organization's IT infrastructure.

Objectives of this Role:

• Manage and enhance internal Public Key Infrastructure (PKI), ADFS (Active Directory Federation Services), and Certificate Lifecycle Management (e.g. Keyfactor Command) to maintain secure, reliable access to enterprise resources.
• Design and implement secure identity and access patterns for Azure and AWS services, including Azure OpenAI, Azure AI Hub/Foundry, Azure Cognitive Services, and AWS Bedrock.
• Lead the design, configuration, and maintenance of Entra ID (Azure AD) app registrations, service principals, and RBAC models that provide controlled, auditable access to cloud and AI workloads.
• Collaborate across IT teams (Cloud, Security, Networking, Applications, Help Desk) to resolve complex issues related to AD, Entra ID, ADFS, PKI, certificates, and cloud identity.
• Drive best practices for identity and access management, Azure and AWS infrastructure governance, and operational scalability across cloud and on-premises environments.
• Maintain strong change control discipline and keep supporting documentation up to date.

Daily and Monthly Responsibilities:

• Manage and support internal PKI and certificate lifecycle processes, including: Administration of CAs, OCSP/CRL endpoints, and certificate trust chains.
• Configuration and operation of Keyfactor Command certificate discovery, issuance, renewal, and revocation.
• Support and maintain identity and federation services, including Active Directory (user and group management, roles, delegation), Entra ID app registrations, service principals, Conditional Access, RBAC, ADFS configuration and integration with internal and external applications.
• Collaborate with IT teams to resolve helpdesk tickets related to: AD and Entra ID authentication and authorization issues.
• ADFS sign-on/federation problems and claims troubleshooting.
• Certificate deployment, trust, and lifecycle problems impacting applications and services.
• Implement and maintain secure access for Azure and AWS AI platforms, including: App registrations and security group-based access controls for Azure OpenAI, Azure AI Hub/Foundry, and Azure Cognitive Services.
• IAM roles, policies, and network/security configuration for AWS service.
• Maintain documentation of identity architectures, PKI designs, AI enablement patterns, and change records for audits and future engineers, and research and propose improvements to identity, PKI, certificate lifecycle, and AI enablement, including automation and governance tooling.

Requirements:

• Requires a Bachelors degree in Information Technology or related degree field with relevant experience. In lieu of a Bachelors degree, 10 years of professional level experience, a high school education or equivalent with related certifications will be considered.
• Related Microsoft certifications are preferred.
• 6 years: Hands‑on experience managing enterprise identity platforms, including: Active Directory domain services. Entra ID (Azure AD) app registrations, service principals, and Conditional Access. ADFS design, configuration, and support.
• 3 years: Managing a PKI environment and certificate lifecycle, including: Internal CA infrastructure, OCSP/CRL, and certificate templates.
• Demonstrated experience designing and securing access for Azure and/or AWS solutions, including at least some of the following: Azure OpenAI, Azure AI Hub/Foundry, Azure Cognitive Services. AWS Bedrock or similar AWS AI/ML services.
• Strong understanding of identity and access management best practices, including: Role‑based access control (RBAC) in Azure and AWS. Least‑privilege design, MFA, and Conditional Access. Governance and operational scalability in cloud environments.
• A valid/clear driver's license is required.

Special Requirements:

Applicant selected will be subject to a government security investigation and must meet eligibility requirements for access to classified information. Applicant must be a U.S. citizen. Job Locations: San Antonio, Texas