Principal Microsoft Entra ID Architect

Unisys Corporation; Center Square (PA); On-site; USD 140,000 - 200,000; Full time

Job summary

Unisys is seeking a highly skilled Security Architect to lead the design, implementation, and governance of Microsoft Entra ID tenants while steering the organization toward cloud-based identity capabilities. The role emphasizes reducing reliance on Active Directory, maintaining secure, resilient operations, and delivering strategic guidance during the transition.

You will provide senior security architecture leadership across Entra ID, AD, MFA, CA policies, and migration workflows, ensuring

Qualifications

• Experience with Entra ID, AD hybrid environments, and cloud-based identity governance.
• Strong hands-on experience with CA policies, MFA implementations, and PIM.
• Proven ability to design secure identity architectures at enterprise scale.

Responsibilities

• Design architect and SME for corporate Entra ID tenant baseline configurations.
• Govern roles, permissions, and consent management to enforce least privilege.
• Lead application access reviews and automate permission reviews.
• Implement tenant disaster recovery and cost-effective strategies.
• Coordinate with security teams on Conditional Access and secure sign-in.

Skills

Microsoft Entra ID

Active Directory

Hybrid identity

MFA

Conditional Access

PowerShell

Graph API

OAuth/OpenID Connect

SAML

Education

BA/BS degree

Master's degree preferred

Tools

Entra Connect

Cloud Sync

Federation

SSO configurations

Azure Key Vault

Job description

What success looks like in this role:

Highly skilled Security Architect with deep expertise in Microsoft Entra ID to lead the design, implementation, and governance of company Entra ID tenants. The primary focus of this position is advancing the corporate IT strategy to reduce reliance on Active Directory by adopting secure, cloud-based identity capabilities in Microsoft Entra ID. While Active Directory remains critical to current operations, the role also provides senior security architecture and strategic guidance to ensure corporate Active Directory environments remain secure, resilient, operationally sound, and appropriately integrated throughout the transition. This role is pivotal in ensuring identity configurations, security, and operational practices align with Zero Trust principles, corporate security policies, and industry best practices. This is a hands‑on role requiring technical depth, architectural leadership, and delivery focus.

Entra ID

• Design architect and SME for corporate tenant directory baseline configurations and settings.


• Govern roles, permissions and consent management, enforcing least privilege through robust delegated and application permission models.


• Manage user and admin consent settings and develop automated workflows for reviewing and approving sensitive permission requests.


• Implement Tenant DR recoverability using best cost-effective means


• Implement application access reviews to validate permissions and ensure least privileged access.


• Design and drive optimal security and cost


• Securely manage application secrets and certificates, integrating with corporate PKI infrastructure and Azure Key Vaults.


• Design and enforce Conditional Access policies based on user, location, device, and risk signals in coordination with security team.


• Conduct threat modeling and risk assessments for authentication and authorization flows.


• Monitor application and service principal activity using Microsoft Sentinel, Azure Monitor, and Entra ID audit logs.


• Define and maintain the enterprise identity architecture leveraging Microsoft Entra ID.


• Lead the adoption of modern authentication (OAuth, OIDC, SAML, FIDO2, passwordless).


• Implement identity lifecycle automation using tools such as Entra ID Governance (IGA), Privileged Identity Management (PIM), and Access Reviews.


• Deploy and manage Entra Connect, Cloud Sync, federation, and SSO configurations.


• Integrate third‑party SaaS and internal applications with Entra ID for SSO and provisioning (SCIM).


• Support the rollout of MFA, passwordless authentication, and secure sign‑in enhancements.

Active Directory Security and Architecture:

• Provide senior security architecture and strategic direction for Active Directory environments across the corporation, with particular emphasis on the company's production environment.


• Define and govern enterprise Active Directory architecture, security, privileged access, resilience, and operational standards.


• Partner with Active Directory engineering and operations teams to ensure critical directory services remain secure, resilient, operationally sound, and recoverable.


• Architect and oversee secure integration between Active Directory and Microsoft Entra ID across hybrid identity services.


• Advance the corporate strategy to reduce reliance on Active Directory by modernizing identity services and transitioning appropriate capabilities to Microsoft Entra ID.


• Assess architectural risks and legacy dependencies, guide remediation and dependency‑reduction initiatives, and provide senior escalation for complex or high‑risk security and design decisions.

Strategic Problem Solving:

• Lead structured problem‑solving for complex, high‑impact identity and security challenges, with primary emphasis on Microsoft Entra ID, cloud identity governance, authentication, authorization, and application access.


• Develop scalable Entra ID target‑state architectures and prioritized roadmaps that balance security, availability, operational supportability, cost, and business requirements.


• Analyze systemic identity risks, legacy dependencies, and integration challenges across cloud and hybrid environments and translate findings into actionable remediation and modernization strategies.


• Provide senior architectural guidance and escalation support for Active Directory security, architecture, resilience, and hybrid identity issues, partnering with the established Active Directory team rather than assuming day‑to‑day operational ownership.


• Drive alignment among security, engineering, operations, governance, leadership, and business‑unit teams to ensure identity standards are adopted and material risks are addressed.


• Track and communicate progress, dependencies, risk reduction, and business impact for major Entra ID and related Active Directory initiatives.


• Stay current on identity‑based threats, Microsoft security capabilities, regulatory requirements, and industry practices to guide the long‑term identity security strategy.

You will be successful in this role if you have:

Required

• BA/BS degree and 8+ years' relevant experience OR equivalent combination of education and experience


• 5+ years primary focus on Microsoft Azure/Entra ID


• Demonstrated experience serving in an engineering or architectural role with responsibility for Microsoft Entra ID, Active Directory, and hybrid identity environments.


• Experience implementing conditional access, MFA, identity protection, and PIM.


• Hands‑on experience with Entra Connect, Cloud Sync, federation, SSO, and app integrations.


• Proven experience securing application registrations, service principals, and enterprise applications in single/multi‑tenant environments.


• Deep expertise in Microsoft Entra ID, including Conditional Access, Entra Directory Configuration, Roles and Permissions, Privileged Identity Management (PIM).


• Proven expertise in PowerShell, Graph API, Automation and ability to create and modify scripts for purposes of configuration settings and report access.


• Strong understanding of modern authentication protocols: SAML, OAuth 2.0, OpenID Connect, Kerberos and LDAP.


• Experience with Microsoft Graph API permissions (Application and Delegated) with deep understanding of how they apply and most secure methods for assignment.

Preferred

• 10 or more years of related experience preferred


• Master's degree preferred

#LI-JV1

This role may require access to export‑controlled commodities and technology. Therefore, to conform to U.S. export control regulations, applicant should be eligible for any required authorizations from the U.S. Government.

Unisys is proud to be an equal opportunity employer that considers all qualified applicants without regard to age, caste, citizenship, color, disability, family medical history, family status, ethnicity, gender, gender expression, gender identity, genetic information, marital status, national origin, parental status, pregnancy, race, religion, sex, sexual orientation, transgender status, veteran status or any other category protected by law.

This commitment includes our efforts to provide for all those who seek to express interest in employment the opportunity to participate without barriers. If you are a US job seeker unable to review the job opportunities herein, or cannot otherwise complete your expression of interest, without additional assistance and would like to discuss a request for reasonable accommodation, please contact our Global Recruiting organization at [e-mail] or alternatively Toll Free: 888-560-1782 (Prompt 4). US job seekers can find more information about Unisys' EEO commitment here.