Entra ID Engineer Consultant - Access Management & Identity Governance

Kalles Group • Seattle, WA

3d • $135,000 - $155,000 • Hybrid

About The Position

As a Senior Microsoft Entra ID Engineer, you will work on assignment with an enterprise client to help lead a large workforce identity migration from a legacy identity provider to Microsoft Entra ID. You will own the design, build, and operation of access management and identity governance in Entra, with significant autonomy. The environment includes authentication for thousands of applications, including complex SAML integrations.

The role covers Conditional Access and authentication strategy, including phishing-resistant MFA and passwordless authentication; Privileged Identity Management; application SSO and provisioning; B2B access; and Entra ID Governance, including entitlement management, access reviews, and lifecycle workflows. You will align Entra-native governance with SailPoint Identity Security Cloud and hybrid Active Directory, automate using Microsoft Graph, PowerShell, and Infrastructure as Code, establish engineering standards, and mentor other engineers.

Requirements

• Bachelor's or master's degree in Computer Science, Cybersecurity, IT, or equivalent experience.
• At least 4 years of experience in IAM or security engineering, with a track record of leading technical projects.
• Deep hands-on experience with Microsoft Entra ID, including Conditional Access, authentication methods, PIM, and Entra ID Protection.
• Hands-on experience with Entra ID Governance, including entitlement management/access packages, access reviews, and lifecycle workflows.
• Expert knowledge of SAML, OAuth 2.0, OIDC, and SCIM, including their security implications.
• Hybrid identity experience with Entra Connect or Cloud Sync and on-premises Active Directory, including governing access across both.
• Experience automating Entra with Microsoft Graph API/Graph PowerShell SDK, PowerShell, Python, and Terraform or Bicep.
• System-level design thinking and the ability to set standards for others to build against.
• Clear communication with engineers and stakeholders, and the ability to operate autonomously in a fast-paced environment.

Nice To Haves

• Certifications such as SC-300, SC-100, AZ-500, CISSP, or SailPoint.
• Experience with Entra governance alongside an enterprise IGA platform such as SailPoint IdentityNow/ISC.
• PAM familiarity, such as BeyondTrust, and understanding of how PAM and PIM complement each other.
• Experience with external/B2B identity at scale, cross-tenant collaboration, and guest governance.
• ITDR exposure and experience feeding identity signals into SIEM/SOAR.
• Experience with Entra Verified ID, Permissions Management, or Global Secure Access.
• Experience in large-scale retail, ecommerce, or high-transaction enterprises.

Responsibilities

• Design and maintain Conditional Access architecture, including persona- and risk-based policies, device and location conditions, session controls, and Authentication Strengths for phishing-resistant MFA.
• Own the authentication methods strategy and rollout, including passwordless/FIDO2/passkeys, Windows Hello for Business, and certificate-based authentication, and retire weaker methods.
• Administer Privileged Identity Management, including eligible assignments, just-in-time activation, approvals, and privileged role and PIM-for-groups reviews.
• Manage application access, including enterprise application SSO using SAML/OIDC, app role assignments, and SCIM provisioning.
• Design external identity and B2B controls, including cross-tenant access settings, guest governance, and partner access patterns.
• Build and operate Entitlement Management, including access packages, catalogs, policies, approval and expiration workflows, and separation-of-duties checks.
• Design and conduct Access Reviews across groups, apps, privileged roles, and guests, including recurring or automated reviews with auto-remediation.
• Implement HR-driven joiner/mover/leaver Lifecycle Workflows and scheduled governance tasks.
• Configure HR-driven inbound provisioning and outbound SCIM app provisioning.
• Integrate Entra-native governance with SailPoint ISC and hybrid Active Directory, defining ownership boundaries and avoiding duplicate controls.
• Automate and manage configuration as code using PowerShell, Microsoft Graph API/Graph PowerShell SDK, and Terraform or Bicep.
• Produce reference designs, standards, and documentation, and review other engineers' designs and configurations.
• Partner with SecOps so identity telemetry supports threat detection.
• Mentor engineers and serve as the Entra access and governance subject-matter expert.
• Use AI tooling to accelerate design and documentation.

Benefits

• Medical plans
• Dental plans
• Vision plans
• 401K with matching
• PTO for salaried employees
• Work/life balance and encouragement to pursue other passions, get outside, and spend time with family
• Work with clients and consultants to set expectations for a manageable workload

What This Job Offers

• Job Type: Full-time
• Career Level: Senior