Senior Identity and Access Engineer

EXOS; Indianapolis (IN); On-site; USD 75,000 - 100,000; Full time

Job summary

EXOS in Indianapolis, Indiana is looking for a skilled individual to manage client identity security standards, including enforcing MFA and managing privileged access. You'll take ownership of standard implementations while automating identity management tasks.

The ideal candidate will have hands-on experience working with Microsoft Entra ID, deploying phishing-resistant MFA, and have knowledge around hybrid identity security. Experience in an MSP or MSSP setting is highly preferred.

Qualifications

• Hands-on production experience with Microsoft Entra ID.
• Automated identity management using Microsoft Graph API and PowerShell.
• Deploying MFA in real environments.
• Experience with hybrid identity and Active Directory security.
• Utilizing identity detection and response tooling.
• Experience in an MSP or MSSP setting is preferred.

Responsibilities

• Own EXOS identity security standards and standards implementation.
• Enforce MFA on client remote access.
• Manage privileged access and set up scheduled access reviews.
• Automate identity management tasks with templates and scripting.
• Produce client-specific identity posture reports.

Skills

Hands-on with Microsoft Entra ID

Automated identity work with Microsoft Graph API

Deploying phishing-resistant MFA

Hardened Active Directory

Identity threat detection tools

MSP/MSSP environment experience

Familiarity with CIS Benchmarks

SC-300 certification

Job description

Responsibilities

• Own the EXOS identity security standard: the Conditional Access baseline, tiered admin model, privileged access configuration, and phishing-resistant MFA standard that every client inherits.


• Enforce MFA on all client remote access, both VPN and internal application access, and block legacy authentication.


• Build and run privileged access management: just-in-time admin elevation, separated cloud-only admin accounts, and on-prem tiered administration with LAPS.


• Deploy phishing-resistant MFA (FIDO2, passkeys, Windows Hello for Business), starting with privileged accounts and expanding to users.


• Stand up scheduled access reviews and stale or over-privileged account reporting, delivered as a recurring remediation list.


• Operate identity threat detection and response tooling to catch token theft, impossible travel, and MFA fatigue, and tune it across client tenants.


• Automate it with reusable templates and scripting (Microsoft Graph API, PowerShell) so the work scales across our client base.


• Produce a per-client identity posture report, and build the runbooks that let the broader team execute the standard.

Qualifications

• Worked hands-on in production with Microsoft Entra ID: Conditional Access, Privileged Identity Management, Identity Protection, and access reviews.


• Automated identity work at scale with Microsoft Graph API and PowerShell, building reusable multi-tenant tooling.


• Deployed phishing-resistant MFA (FIDO2, passkeys, Windows Hello for Business) in real environments.


• Hardened on-prem Active Directory: tiered admin models, LAPS, and the hybrid identity attack paths that enable lateral movement.


• Worked with identity threat detection and response tooling.


• Delivered identity across many client environments in an MSP or MSSP setting (preferred).


• Familiar with CIS Benchmarks and the compliance regimes our clients face


• Earned relevant certifications such as SC-300, Identity and Access Administrator (a plus, not a substitute for hands-on experience).