Sr. Entra ID & Identity Architect / Azure Active Directory Admin - W2 - No Sponsorship

Keylent Inc; Nashville (TN); On-site; USD 150,000 - 210,000; Full time

Job summary

Keylent Inc. is seeking an Microsoft Entra ID Lead to serve as the primary SME for enterprise identity, authentication, and access governance.

You will guide enterprise clients through identity modernizations, Zero Trust implementations, and hybrid-to-cloud migrations while leading implementation teams. The role combines hands-on Entra ID engineering with client engagement, requiring strong communication and consulting capabilities to translate risk into security policy and deliver

Qualifications

• 10+ years in Enterprise IAM with hands-on architecture and engineering experience.
• Deep expertise with Microsoft Entra ID and security controls.
• Experience translating risk into security policies and executive-ready deliverables.

Responsibilities

• Lead discovery workshops, architectural assessments, and roadmap sessions with client stakeholders.
• Architect, configure, and optimize Entra ID tenants across multi-directory and multi-cloud environments.
• Design SSO, federation, and external identities for SaaS and on-prem apps.
• Develop automation, monitoring, and audit processes using PowerShell and Graph APIs.
• Provide Tier-3/4 escalation support for complex federation issues.

Skills

IAM leadership

Entra ID architecture

Conditional Access

PIM (Privileged Identity)

Identity Protection

Passwordless authentication

PowerShell scripting

Microsoft Graph API

Tools

PowerShell

Microsoft Graph API/SDK

Job description

The Microsoft Entra ID Lead serves as the primary subject matter expert and technical authority for enterprise identity, authentication, and access governance. This role bridges deep hands-on engineering with client engagement, guiding enterprise clients through identity modernizations, Zero Trust architecture implementations, hybrid-to-cloud migrations, and access governance.

The ideal candidate combines direct execution in Microsoft Entra ID with strong communication and consulting expertise, capable of leading client discovery workshops, translating business risk into security policy, and directing implementation teams.

Key Responsibilities

1. Client Engagement & Solution Advisory

• Lead technical discovery, architectural assessments, and roadmap workshops directly with client stakeholders (CISOs, Enterprise Architects, IT Directors, and application owners).
• Translate complex identity security concepts, and compliance mandates into clear business justifications and executive ready deliverables.
• Act as the client's trusted advisor for Zero Trust adoption, modern authentication strategies, and identity lifecycle governance.
• Produce comprehensive solution blueprints, Statements of Work (SOWs), High-Level/Low-Level Designs (HLD/LLD), and migration playbooks.

2. Hands-on Entra ID Engineering & Security Architecture

• Architect, configure, and optimize Microsoft Entra ID tenants across enterprise scale multi-directory and multi-cloud footprints.
• Design and implement robust Conditional Access Policies, continuous access evaluation (CAE), risk-based sign-in policies, and phishing resistant authentication (FIDO2, Windows Hello for Business, Certificate-Based Authentication).
• Implement and harden Microsoft Entra Privileged Identity Management (PIM) for Azure and Entra ID roles, incorporating just-in-time (JIT) access, time bound activations, and multi-stage approval workflows.
• Configure Entra ID Governance, including access reviews, entitlement management catalogs, and lifecycle workflows for automated joiner-mover-leaver (JML) processes.
• Lead hybrid identity integrations and migrations utilizing Microsoft Entra Connect Sync and Cloud Sync, resolving synchronization errors, schema extensions, and password writeback configurations.

3. Application Integration, Federation & External Identities

• Architect enterprise single sign-on (SSO) and user provisioning across SaaS and on-premises applications using SAML 2.0, OpenID Connect (OIDC), OAuth 2.0, and SCIM.
• Design secure collaboration architectures for partners and contractors using Microsoft Entra External ID (B2B) and cross-tenant access settings.
• Guide application development teams on integrating custom enterprise applications with Microsoft identity platform, Managed Identities, and Microsoft Graph APIs.

4. Automation, Monitoring & Operational Excellence

• Develop automated workflows, provisioning pipelines, and audit reporting using PowerShell (Microsoft.Graph module), Microsoft Graph REST API, and Azure Logic Apps.
• Integrate Entra audit, sign-in, and risk logs with enterprise SIEM/SOAR platforms (e.g., Microsoft Sentinel, Splunk) for threat detection and posture monitoring.
• Serve as the Tier-3/4 escalation authority for critical production incidents, misconfigurations, and complex federation failures.

Candidate Qualifications

Technical & Hands-On Skills

• 10+ years of hands-on experience in Enterprise Identity & Access Management (IAM), with at least 6+ years dedicated to architecture, administration, and engineering in Microsoft Entra ID (formerly Azure Active Directory).
• Demonstrated mastery of Entra security controls: Conditional Access, PIM, Identity Protection, Microsoft Authenticator, and Passwordless mechanisms.
• Production proficiency with identity federation protocols (SAML, OIDC, OAuth 2.0, WS-Fed) and directory protocols (LDAP, Kerberos, SCIM).
• Advanced scripting and automation skills utilizing PowerShell and Microsoft Graph API / SDK.
• Practical familiarity with Microsoft Entra Suite extensions, such as Entra Global Secure Access (Internet Access & Private Access) and Entra Verified ID.

Consulting & Interpersonal Strengths

• Proven track record in a client-facing consulting, professional services, or solutions architecture capacity.
• Exceptional verbal and written communication skills with demonstrated experience presenting to both deep technical teams and executive-level leadership.
• Strong facilitation skills for leading client architectural workshops, dispute resolution, and stakeholder requirement gathering.
• Ability to mentor junior identity engineers and provide technical oversight across concurrent customer engagements.

Preferred Certifications

• Microsoft Certified: Identity and Access Administrator Associate (SC-300)
• Microsoft Certified: Cybersecurity Architect Expert (SC-100)
• Microsoft Certified: Azure Security Engineer Associate (AZ-500)
• CISSP (Certified Information Systems Security Professional) or CISM