Senior Entra ID IAM Engineer

SPECTRAFORCE; Phoenix (AZ); On-site; USD 83,000 - 90,000; Full time

Job summary

Spectraforce is seeking an experienced Identity Architecture & Strategy professional to design, implement, and govern enterprise IAM across Entra ID and Active Directory. You will shape long-term identity strategies, orchestrate secure hybrid identities, and drive Zero Trust adoption while aligning with regulatory controls.

The role focuses on secure identity governance, SSO integrations, and modernizing AD posture, with a preference for on-site presence in a multi-location setup.

Qualifications

• 8+ years of experience in Identity & Access Management, architecture or engineering; SSO protocols: OAuth2, OIDC, SAML, WS-Fed; Identity lifecycle automation and provisioning; Zero Trust principles.
• Strong knowledge of MFA, passwordless, risk-based policies, and authentication flows.
• Experience securing hybrid identity using Entra Connect, federation services, and cloud-only patterns.
• Expertise building Terraform IaC resources and guardrails for identity services through reusable modules and automated CI/CD pipelines.
• Proficiency with PowerShell or automation frameworks.
• Strong understanding of IAM risk management, audit requirements, and regulatory standards.

Responsibilities

• Design, implement, and maintain end-to-end Identity & Access Management architectures using Microsoft Entra ID and Active Directory.
• Establish a long term identity strategy aligned with business, security, and regulatory requirements.
• Architect secure hybrid identity models including Entra Connect, cloud sync strategies, and identity lifecycle automation.
• Drive adoption of Zero Trust identity principles, including continuous evaluation and least-privilege access.
• Lead design and optimization of Conditional Access policies, authentication flows, MFA, passwordless strategies, and identity protection.
• Architect, standardize, and provide governoversight for Entra ID Governance capabilities—PIM, access reviews, entitlement management, custom roles, and segregation of duties.
• Oversee configuration of Entra applications, service principals, federations, SCIM provisioning, and SSO integrations (SAML/OIDC/OAuth2).
• Design secure, resilient, and scalable AD forests, domains, GPO structures, and privileged access boundaries.
• Lead initiatives to modernize AD security posture and lifecycle management.
• Implement AD hardening and remediation of legacy dependencies.
• Develop identity standards, patterns, security baselines, and governance frameworks.
• Ensure compliance with SOX, HIPAA, GDPR, ISO 27001 and internal audits.
• Provide guidance for RBAC/ABAC models and identity lifecycle management.
• Collaborate with cloud platform and DevSecOps teams to integrate identity controls into cloud landing zones and CI/CD.
• Partner with security operations to integrate identity telemetry and incident response workflows.
• Work with Security Engineering and Infrastructure teams on architectural direction during migrations.
• Deliver architecture diagrams, roadmaps, threat models, and solution documentation.
• Drive IAM as a shared enterprise platform and mentor engineers on identity design.

Skills

Identity & Access Management

MFA / passwordless

Zero Trust

Terraform IaC

PowerShell

SSO protocols OAuth2/OIDC/SAML

Regulatory compliance (SOX HIPAA GDPR)

Tools

Terraform

PowerShell

Entra ID / Azure AD

Job description

Location: Candidate can sit in Phoenix/Southlake/Austin—preference is 4 days per week on-site.

Duration: 6 Months to start

Identity Architecture & Strategy

• Design, implement, and maintain end-to-end Identity & Access Management architectures using Microsoft Entra ID and Active Directory.
• Establish a long term identity strategy aligned with business, security, and regulatory requirements.
• Architect secure hybrid identity models including Entra Connect, cloud sync strategies, and identity lifecycle automation.
• Drive adoption of Zero Trust identity principles, including continuous evaluation and least-privilege access.
• Lead design and optimization of Conditional Access policies, authentication flows, MFA, passwordless strategies (FIDO2, Windows Hello Business), and identity protection.
• Architect, standardize, and provide governoversight for Entra ID Governance capabilities—PIM, access reviews, entitlement management, custom roles, and segregation of duties.
• Oversee configuration of Entra applications, service principals, federations, SCIM provisioning, and SSO integrations (SAML/OIDC/OAuth2).

Active Directory (AD) & Hybrid Identity

• Design secure, resilient, and scalable Active Directory forests, domains, GPO structures, and privileged access boundaries.
• Lead initiatives to modernize AD security posture (tiered administration models, privileged access isolationESAE cleans-up, delegated administration, and secure baselines).
• Implement AD hardening, lifecycle management, group governance, and remediation of legacy dependencies.

I AM Governance & Security

• Develop identity standards, patterns, security baselines, and governance frameworks.
• Ensure compliance with regulatory requirements such as SOX, HIPAA, GDPR, ISO 27001, and internal audit controls.
• Provide guidance for RBAC/ABAC models, identity lifecycle management, privileged access governance, and application onboarding.
• Design identity controls that are auditable, measurable, and automatable, supporting internal risk assessments and regulatory compliance.
• Collaborate with cloud platform and DevSecOps teams to integrate identity controls into cloud landing zones, CI/CD pipelines, and enterprise architectures.
• Partner with security operations to integrate identity telemetry, threat detection, and incident response workflows.

Cross-Functional Collaboration

• Work closely with Security Engineering, Application Owners, Cloud Platform Engineering & Architecture, and Infrastructure teams.
• Provide architectural direction during acquisition integration, cloud migrations, and modernization projects.
• Deliver architecture diagrams, roadmaps, threat models, and solution documentation.

Thought Leadership

• Drive IAM as a shared enterprise platform, balancing security, user experience, and operational resiliency.
• Stay current with identity trends, Entra roadmap updates, and emerging threats.
• Recommend continuous improvement opportunities across authentication, authorization, and identity governance.
• Mentor engineers and guide best practices on identity design and operations.

Required Qualifications

• 8+ years of experience in Identity & Access Management, architecture or engineering.
  • SSO protocols: OAuth2, OIDC, SAML, WS-Fed
  • Identity lifecycle automation and provisioning
  • Zero Trust architecture principles
• Strong knowledge of MFA, passwordless, risk-based policies, and authentication flows.
• Experience securing hybrid identity using Entra Connect, federation services, and cloud-only patterns.
• Expertise building Terraform IaC resources and guardrails for identity services through reusable modules and automated CI/CD pipelines.
• Proficiency with PowerShell or automation frameworks.
• Strong understanding of IAM risk management, audit requirements, and regulatory standards.

Preferred Qualifications

• Experience with:
  • Privileged Access Workstations (PAW)
  • Microsoft Identity Manager (MIM) or other ILM solutions
  • Conditional Access advanced configurations and automation
  • Enterprise-scale identity consolidation and domain migration projects
  • Modern IAM stacks (SailPoint, CyberArk, Okta)
• Background security architecture, threat modeling, or penetration testing related to identity systems.

Soft Skills

• Exceptional communication and leadership capabilities.
• Ability to work across organizational boundaries with technical and executive stakeholders.
• Strong problem-solving, decision-making, and strategic thinking skills.
• Ability to simplify complex identity concepts into actionable guidance.

At SPECTRAFORCE, we are committed to maintaining a workplace that ensures fair compensation and wage transparency in adherence with all applicable state and local laws.This position's pay range is $60.00/hr - $65.00/hr.