Sr Identity Engineer

Lockton; Kansas City (MO); On-site; USD 120,000 - 170,000; Full time

Job summary

Lockton seeks a Senior Identity Engineer – Operations to design, operate, and secure Microsoft Entra ID across the enterprise, including hybrid identity with AD and Entra Connect. You will own identity governance, Conditional Access, privileged access, app identities, and modern authentication controls, while acting as senior escalation for complex access issues.

You will collaborate with security, platform, and regional teams to maintain least-privilege, audit-ready identity services and

Qualifications

• Engineer, operate, and secure Microsoft Entra ID in an enterprise environment, including hybrid identity with Active Directory and Entra Connect, directory health, monitoring, and incident response.
• Design, implement, and maintain Conditional Access policies enforcing MFA, device trust, sign-in risk, and Zero Trust principles across access scenarios.
• Design and enforce identity standards that eliminate network-based trust assumptions, ensuring MFA and risk-based access controls are consistently applied.
• Review, approve, and operationalize admin consent for third-party enterprise application integrations across the tenant.
• Own enterprise application and service principal onboarding, enforcing least-privilege access models and secure authentication patterns.
• Create, manage, and govern App Registrations, including secret and certificate lifecycle management, rotation standards, and expiration monitoring.
• Design and enforce least-privilege Microsoft Graph permission models for applications and identity automation.
• Define and maintain standards that prevent interactive sign-in for service accounts, leveraging Conditional Access and non-interactive authentication models.
• Define and enforce identity security guardrails for privileged access, MFA requirements, service accounts, and break-glass scenarios.
• Implement and govern Microsoft Entra Privileged Identity Management (PIM) for administrative roles, just-in-time elevation, approval workflows, access reviews, and privileged access monitoring.
• Design and administer Microsoft Entra Administrative Units to delegate identity and user management with scoped administrative control across regions, business units, and support teams.
• Operate and evolve modern authentication and MFA methods globally, aligning with Microsoft Entra Authentication Methods and organizational security standards.
• Support and standardize passwordless authentication approaches, including FIDO2 and hardware security keys, across regions and business units.
• Support B2B, B2C, cross-tenant, and external identity scenarios for partners, vendors, and client-facing platforms.
• Partner with platform, security, and Azure engineering teams to design and deliver secure Azure access models, role assignments, and identity integrations.
• Act as the escalation point for complex identity-related incidents, authentication failures, and access issues.
• Produce audit-safe documentation and evidence supporting security, compliance, and regulatory requirements.
• Demonstrate a strong understanding of Microsoft 365 (M365) and its identity integrations with Entra ID, including authentication flows, access controls, and tenant-level governance considerations.

Responsibilities

• Designs, operates, and secures Microsoft Entra ID across the enterprise and partners with security, platform, and regional teams.

Skills

Microsoft Entra ID

Conditional Access

Zero Trust

Identity governance

Privileged access management

App registrations

Graph permissions

Non-interactive authentication

Just-in-time elevation

MFA concepts

Tools

Entra Admin Center

Azure AD Connect

PIM

Graph API

Microsoft 365 Identity

Job description

Your Responsibilities

The Senior Identity Engineer – Operations designs, operates, and secures Microsoft Entra ID and its integrations across the enterprise. This role owns identity governance, Conditional Access, privileged access, application identities, and modern authentication controls, while serving as a senior escalation point for complex access and authentication issues. The engineer partners with security, platform, and regional teams to maintain resilient, least-privilege identity services and audit-ready operational standards.

Qualifications

• Engineer, operate, and secure Microsoft Entra ID in an enterprise environment, including hybrid identity with Active Directory and Entra Connect, directory health, monitoring, and incident response.
• Design, implement, and maintain Conditional Access policies enforcing MFA, device trust, sign-in risk, and Zero Trust principles across access scenarios.
• Design and enforce identity standards that eliminate network-based trust assumptions, ensuring MFA and risk-based access controls are consistently applied.
• Review, approve, and operationalize admin consent for third-party enterprise application integrations across the tenant.
• Own enterprise application and service principal onboarding, enforcing least-privilege access models and secure authentication patterns.
• Create, manage, and govern App Registrations, including secret and certificate lifecycle management, rotation standards, and expiration monitoring.
• Design and enforce least-privilege Microsoft Graph permission models for applications and identity automation.
• Define and maintain standards that prevent interactive sign-in for service accounts, leveraging Conditional Access and non-interactive authentication models.
• Define and enforce identity security guardrails for privileged access, MFA requirements, service accounts, and break-glass scenarios.
• Implement and govern Microsoft Entra Privileged Identity Management (PIM) for administrative roles, just-in-time elevation, approval workflows, access reviews, and privileged access monitoring.
• Design and administer Microsoft Entra Administrative Units to delegate identity and user management with scoped administrative control across regions, business units, and support teams.
• Operate and evolve modern authentication and MFA methods globally, aligning with Microsoft Entra Authentication Methods and organizational security standards.
• Support and standardize passwordless authentication approaches, including FIDO2 and hardware security keys, across regions and business units.
• Support B2B, B2C, cross-tenant, and external identity scenarios for partners, vendors, and client-facing platforms.
• Partner with platform, security, and Azure engineering teams to design and deliver secure Azure access models, role assignments, and identity integrations.
• Act as the escalation point for complex identity-related incidents, authentication failures, and access issues.
• Produce audit-safe documentation and evidence supporting security, compliance, and regulatory requirements.
• Demonstrate a strong understanding of Microsoft 365 (M365) and its identity integrations with Entra ID, including authentication flows, access controls, and tenant-level governance considerations.