Senior Entra Identity Governance Engineer

Turnberry Solutions, Inc.; Waltham (MA); Remote; USD 135,000 - 195,000; Full time

Benefits offered by this job

Healthcare benefits

401(k) with match

Flexible time off

Parental leave

Flexible work arrangements

Job summary

Turnberry Solutions, Inc. is seeking a Senior Entra Identity Governance Engineer to join our Digital Modernization practice. You will partner with IT service teams, business stakeholders, and cybersecurity to design governed access and lifecycle controls.

Responsibilities include entitlement management, self-service access, and automated provisioning. This role focuses on Entra Identity Governance, agent identities, and integration with AI workflows, with a 100% remote work setup.

Qualifications

• 5+ years of IAM/identity governance experience.
• 2+ years implementing Microsoft Entra ID Governance or Entitlement Management.
• Hands-on experience with access package catalogs, assignment policies, approvals, expirations, and access reviews.
• Experience with Microsoft Entra ID, Microsoft 365, enterprise applications, B2B collaboration, Microsoft Graph, and PowerShell.
• Ability to design end-to-end governance workflows and troubleshoot integrations.

Responsibilities

• Lead discovery and design of entitlement management catalogs and access packages.
• Collaborate with AI platform, cybersecurity, and application teams to govern agent identities and permissions.
• Design and automate provisioning/deprovisioning and access reviews.
• Coordinate UAT, rollout communications, and handoff to operations.

Skills

IAM governance

Entra ID governance

Access packages

RBAC / PIM

PowerShell

Microsoft Graph

Tools

Microsoft Graph

PowerShell

ServiceNow

Azure Logic Apps

Job description

Duration: 13+ Months

Location: MA-Waltham, 100% Remote

Overview: Every Turnberry consultant belongs to a practice, an internal group of consultants and leaders with shared experience and expertise. Each of these practices aligns to one of the core services Turnberry offers to clients. As a Senior Entra Identity Governance Engineer, you will join Turnberry's Digital Modernization practice, where technology and strategy combine to deliver exceptional digital experiences, empowering organizations to thrive in today's digital market.

Responsibilities

• Business Partnership, Requirements Discovery, and Access Modeling
  • Partner directly with IT service teams, application owners, business process owners, and cybersecurity stakeholders to understand service delivery models, user populations, operational workflows, and access requirements
  • Lead discovery workshops and stakeholder interviews to document business roles, access personas, entitlement dependencies, approval authorities, ownership, and joiner/mover/leaver scenarios
  • Translate business requirements into scalable Entitlement Management catalogs, Access Packages, resource groupings, assignment policies, and approval and expiration controls
  • Assess existing access models and identify opportunities to replace manual group assignments and ticket-based provisioning with governed self-service access
  • Define and validate access matrices, catalog ownership, requestor eligibility, approval routing, review cadence, separation-of-duties constraints, and exception handling with service owners
  • Coordinate user acceptance testing, rollout communications, service desk readiness, and operational handoff; maintain ongoing relationships to evolve catalogs and packages as business needs change
  • Collaborate with AI platform and application teams to discover agent use cases, sponsors, non-human identities, permissions, and governance workflows, and translate these into governed onboarding and lifecycle controls
• Entitlement Management and Access Packages
  • Design and administer catalogs, access packages, resource roles, assignment policies, and delegated catalog ownership
  • Configure request eligibility, multi-stage approvals, sponsor/manager approval, assignment expiration, extensions, and automated removal
  • Govern access to security groups, Microsoft 365 groups, Teams, SharePoint Online sites, and enterprise applications
  • Implement B2B guest access, connected organizations, contractor access, and external collaboration governance
  • Migrate manually provisioned access to governed, self-service access packages with minimal business disruption
• Identity Lifecycle and Access Reviews
  • Implement joiner, mover, and leaver controls using Entra Lifecycle Workflows and integrations with HR and ITSM systems
  • Design recurring access reviews for applications, groups, guests, and privileged access, with documented ownership and remediation
  • Automate provisioning, deprovisioning, access expiration, certification evidence, and exception handling
  • Align review frequency and evidence with internal policy and applicable SOX/GxP requirements
• AI Agent and Non-Human Identity Governance
  • Design governance processes for Microsoft 365 agents, Copilot Studio agents, autonomous agents, and associated agent user identities
  • Create agent intake, registration, ownership, business sponsorship, risk classification, approval, and periodic recertification workflows
  • Integrate ServiceNow approvals and Microsoft Entra controls to enforce approved versus unapproved agent access, where technically supported
  • Use Microsoft Entra custom security attributes, Conditional Access for supported agent identities, and automation to support policy enforcement and lifecycle controls
  • Develop controls for agent onboarding, credential and permission reviews, ownership changes, decommissioning, incident response, and audit trails
  • Partner with AI, Cybersecurity, Architecture, and application teams to govern agent permissions and access to enterprise data
• Automation, Integration, and Operations
  • Build Microsoft Graph API, PowerShell, Azure Logic Apps, and ServiceNow integrations for governance workflows
  • Troubleshoot assignment failures, approval routing, provisioning, access review, and agent governance exceptions
  • Create implementation documentation, operating procedures, monitoring, metrics, and support handoff materials
  • Apply least privilege, separation of duties, RBAC, PIM, and Zero Trust principles

Qualifications

• Demonstrated ability to independently facilitate business requirements workshops, build stakeholder relationships, map access personas and entitlements, and translate findings into production Access Package and catalog designs
• 5+ years of IAM/identity governance experience, including 2+ years implementing Microsoft Entra ID Governance or Entitlement Management
• Hands-on production experience with access package catalogs, assignment policies, approvals, expirations, and access reviews
• Experience with Microsoft Entra ID, Microsoft 365, enterprise applications, B2B collaboration, Microsoft Graph, and PowerShell
• Ability to design end-to-end governance workflows, troubleshoot complex integrations, and communicate with business and technical owners
• Understanding of non-human identities, agent permissions, and governance risks associated with AI-driven automation

Preferred Qualifications

• Experience with Copilot Studio, Microsoft 365 agents, autonomous agents, and Microsoft Entra agent identity capabilities
• Experience integrating ServiceNow with Entra, Azure Logic Apps, Azure Functions, and lifecycle workflows
• Knowledge of Entra PIM, role-assignable groups, Conditional Access, and custom security attributes
• Experience with Workday, Beeline, or similar authoritative identity sources
• Experience in regulated pharmaceutical/life sciences environments; SC-300 certification preferred

The salary range for this role is $135,000 to $195,000 or the hourly equivalent. Pay is based on several factors including but not limited to education, work experience, certifications, etc.

In addition to your salary, Turnberry Solutions offers benefits such as:

• comprehensive healthcare package (medical, dental, vision)
• disability and group term life insurance
• health and flexible spending accounts
• a utilization bonus
• 401(k) with match
• flexible time off for salaried employees
• parental leave for salaried employees
• flexible work arrangements (all benefits are subject to eligibility requirements)

No matter where or when you begin a career with Turnberry, you'll find a far-reaching choice of benefits and incentives.

At Turnberry, we are committed to creating a positive and connected work environment for all and are fully invested in and focused on hiring and growing a diverse team of high performers. We believe that uniqueness in ideas, experiences, and backgrounds make us a better Turnberry: Turnberry is an Equal Employment Opportunity employer, and recruits, employs, trains, compensates, and promotes regardless of age, ancestry, family medical or genetic information, gender identity and expression, marital, military, or veteran status; national and ethnic origin; physical or mental disability; political affiliation; pregnancy; race; religion; sex; sexual orientation; and any other protected characteristics.

Americans With Disabilities Act (ADA)

Turnberry will provide reasonable accommodation with our application process upon request as required to comply with applicable laws. If you have a disability and require accommodation assistance in this application process, please send an email to our Human Resources department at [e-mail].