Principal Microsoft Entra ID Architect

Unisys; Center Square (PA); On-site; USD 140,000 - 170,000; Full time

Job summary

Unisys seeks a highly skilled Security Architect specializing inMicrosoft Entra ID to lead design, implementation, and governance of Entra ID tenants. The role focuses on reducing Active Directory reliance by adopting secure cloud-based identity capabilities, while keeping operations secure during the transition.

You will provide senior architectural guidance, implement CA policies, manage SSO and app integrations, and automate identity workflows.

Qualifications

• 8+ years’ relevant experience or equivalent combination of education and experience.
• 5+ years primary focus on Microsoft Azure/Entra ID.
• Experience in engineering or architecture with Entra ID, Active Directory, and hybrid identity.
• Experience implementing conditional access, MFA, identity protection, and PIM.
• Hands-on experience with Entra Connect, Cloud Sync, federation, SSO, and app integrations.
• Strong knowledge of modern authentication protocols: SAML, OAuth 2.0, OIDC, Kerberos/LDAP.

Responsibilities

• Lead design, implementation, and governance of Entra ID tenant configurations.
• Architect and oversee Active Directory integration with Entra ID in hybrid environments.
• Define and enforce least-privilege permissions and consent management policies.
• Develop automated workflows for reviewing sensitive permission requests.
• Implement tenant disaster recovery concepts and application access reviews.
• Drive secure application registrations, service principals, and enterprise app configurations.

Skills

Microsoft Entra ID

Active Directory

Hybrid identity

Zero Trust

PowerShell

Graph API

OAuth 2.0

OpenID Connect

SAML

Kerberos/LDAP

Education

BA/BS degree

Master's degree

Tools

Entra Connect

Cloud Sync

Federation

SSO

App integrations

Microsoft Sentinel

Azure Monitor

Azure Key Vault

Job description

What success looks like in this role

Highly skilled Security Architect with deep expertise in Microsoft Entra ID to lead the design, implementation, and governance of company Entra ID tenants. The primary focus of this position is advancing the corporate IT strategy to reduce reliance on Active Directory by adopting secure, cloud-based identity capabilities in Microsoft Entra ID. While Active Directory remains critical to current operations, the role also provides senior security architecture and strategic guidance to ensure corporate Active Directory environments remain secure, resilient, operationally sound, and appropriately integrated throughout the transition. This role is pivotal in ensuring identity configurations, security, and operational practices align with Zero Trust principles, corporate security policies, and industry best practices. This is a hands-on role requiring technical depth, architectural leadership, and delivery focus. Entra ID Design architect and SME for corporate tenant directory baseline configurations and settings. Govern roles, permissions and consent management, enforcing least privilege through robust delegated and application permission models. Manage user and admin consent settings and develop automated workflows for reviewing and approving sensitive permission requests. Implement Tenant DR recoverability using best cost-effective means Implement application access reviews to validate permissions and ensure least privileged access. Design and drive optimal security and cost Securely manage application secrets and certificates, integrating with corporate PKI infrastructure and Azure Key Vaults. Design and enforce Conditional Access policies based based on user, location, device, and risk signals in coordination with security team. Conduct threat modeling and risk assessments for authentication and authorization flows. Monitor application and service principal activity using Microsoft Sentinel, Azure Monitor, and Entra ID audit logs. Define and maintain the enterprise identity architecture leveraging Microsoft Entra ID. Lead the adoption of modern authentication (OAuth, OIDC, SAML, FIDO2, passwordless). Implement identity lifecycle automation using tools such as Entra ID Governance (IGA), Privileged Identity Management (PIM), and Access Reviews. Deploy and manage Entra Connect, Cloud Sync, federation, and SSO configurations. Integrate third-party SaaS and internal applications with Entra ID for SSO and provisioning (SCIM). Support the rollout of MFA, passwordless authentication, and secure sign-in enhancements. Active Directory Security and Architecture: Provide senior security architecture and strategic direction for Active Directory environments across the corporation, with particular emphasis on the company’s production environment. Define and govern enterprise Active Directory architecture, security, privileged access, resilience, and operational standards. Partner with Active Directory engineering and operations teams to ensure critical directory services remain secure, resilient, operationally sound, and recoverable. Architect and oversee secure integration between Active Directory and Microsoft Entra ID across hybrid identity services. Advance the corporate strategy to reduce reliance on Active Directory by modernizing identity services and transitioning appropriate capabilities to Microsoft Entra ID. Assess architectural risks and legacy dependencies, guide remediation and dependency-reduction initiatives, and provide senior escalation for complex or high-risk security and design decisions. Strategic Problem Solving: Lead structured problem-solving for complex, high-impact identity and security challenges, with primary emphasis on Microsoft Entra ID, cloud identity governance, authentication, authorization, and application access. Develop scalable Entra ID target-state architectures and prioritized roadmaps that balance security, availability, operational supportability, cost, and business requirements. Analyze systemic identity risks, legacy dependencies, and integration challenges across cloud and hybrid environments and translate findings into actionable remediation and modernization strategies. Provide senior architectural guidance and escalation support for Active Directory security, architecture, resilience, and hybrid identity issues, partnering with the established Active Directory team rather than assuming day-to-day operational ownership. Drive alignment among security, engineering, operations, governance, leadership, and business-unit teams to ensure identity standards are adopted and material risks are addressed. Track and communicate progress, dependencies, risk reduction, and business impact for major Entra ID and related Active Directory initiatives. Stay current on identity-based threats, Microsoft security capabilities, regulatory requirements, and industry practices to guide the long-term identity security strategy.

You will be successful in this role if you have:

• Required BA/BS degree and 8+ years’ relevant experience OR equivalent combination of education and experience
• 5+ years primary focus on Microsoft Azure/Entra ID
• Demonstrated experience serving in an engineering or architectural role with responsibility for Microsoft Entra ID, Active Directory, and hybrid identity environments.
• Experience implementing conditional access, MFA, identity protection, and PIM.
• Hands-on experience with Entra Connect, Cloud Sync, federation, SSO, and app integrations.
• Proven experience securing application registrations, service principals, and enterprise applications in single/multi-tenant environments.
• Deep expertise in Microsoft Entra ID, including Conditional Access, Entra Directory Configuration, Roles and Permissions, Privileged Identity Management (PIM).
• Proven expertise in PowerShell, Graph API, Automation and ability to create and modify scripts for purposes of configuration settings and report access.
• Strong understanding of modern authentication protocols: SAML, OAuth 2.0, OpenID Connect, Kerberos and LDAP.
• Experience with Microsoft Graph API permissions (Application and Delegated) with deep understanding of how they apply and most secure methods for assignment.
• Preferred 10 or more years of related experience
• Preferred Master’s degree
• #LI-JV1

This role may require access to export-controlled commodities and technology. Therefore, to conform to U.S. export control regulations, applicant should be eligible for any required authorizations from the U.S. Government.

Unisys is proud to be an equal opportunity employer that considers all qualified applicants without regard to age, caste, citizenship, color, disability, family medical history, family status, ethnicity, gender, gender expression, gender identity, genetic information, marital status, national origin, parental status, pregnancy, race, religion, sex, sexual orientation, transgender status, veteran status or any other category protected by law. This commitment includes our efforts to provide for all those who seek to express interest in employment the opportunity to participate without barriers.

Unisys is a global technology solutions company that powers breakthroughs for the world’s leading organizations. Our solutions - cloud, AI, digital workplace, logistics and enterprise computing - help our clients challenge the status quo and unlock their full potential. To learn how we have been helping clients push what’s possible for more than 150 years, visit unisys.com and follow us on LinkedIn. https://www.unisys.com/unisys-legal/recruiting Notice for U.S. Applicants: Unisys is an Equal Opportunity Employer - Minorities/ Females/ Veterans/ Individuals with Disabilities/ Sexual Orientation/ Gender Identity