Senior Entra ID & Identity Security Architect

Lockton

Kansas City (MO)

On-site

USD 120,000 - 170,000

Full time

25 hours ago

Be an early applicant

Application generator

Get a reply from this employer — a resume and cover letter tailored to exactly what they’re hiring for.

Get past ATS filters

Job summary

Lockton seeks a Senior Identity Engineer – Operations to design, operate, and secure Microsoft Entra ID across the enterprise, including hybrid identity with AD and Entra Connect. You will own identity governance, Conditional Access, privileged access, app identities, and modern authentication controls, while acting as senior escalation for complex access issues.

You will collaborate with security, platform, and regional teams to maintain least-privilege, audit-ready identity services and

Qualifications

Engineer, operate, and secure Microsoft Entra ID in an enterprise environment, including hybrid identity with Active Directory and Entra Connect, directory health, monitoring, and incident response.
Design, implement, and maintain Conditional Access policies enforcing MFA, device trust, sign-in risk, and Zero Trust principles across access scenarios.
Design and enforce identity standards that eliminate network-based trust assumptions, ensuring MFA and risk-based access controls are consistently applied.
Review, approve, and operationalize admin consent for third-party enterprise application integrations across the tenant.
Own enterprise application and service principal onboarding, enforcing least-privilege access models and secure authentication patterns.
Create, manage, and govern App Registrations, including secret and certificate lifecycle management, rotation standards, and expiration monitoring.
Design and enforce least-privilege Microsoft Graph permission models for applications and identity automation.
Define and maintain standards that prevent interactive sign-in for service accounts, leveraging Conditional Access and non-interactive authentication models.
Define and enforce identity security guardrails for privileged access, MFA requirements, service accounts, and break-glass scenarios.
Implement and govern Microsoft Entra Privileged Identity Management (PIM) for administrative roles, just-in-time elevation, approval workflows, access reviews, and privileged access monitoring.
Design and administer Microsoft Entra Administrative Units to delegate identity and user management with scoped administrative control across regions, business units, and support teams.
Operate and evolve modern authentication and MFA methods globally, aligning with Microsoft Entra Authentication Methods and organizational security standards.
Support and standardize passwordless authentication approaches, including FIDO2 and hardware security keys, across regions and business units.
Support B2B, B2C, cross-tenant, and external identity scenarios for partners, vendors, and client-facing platforms.
Partner with platform, security, and Azure engineering teams to design and deliver secure Azure access models, role assignments, and identity integrations.
Act as the escalation point for complex identity-related incidents, authentication failures, and access issues.
Produce audit-safe documentation and evidence supporting security, compliance, and regulatory requirements.
Demonstrate a strong understanding of Microsoft 365 (M365) and its identity integrations with Entra ID, including authentication flows, access controls, and tenant-level governance considerations.