Entra ID Engineer Consultant - Access Management & Identity Governance

Kalles Group•Seattle, WA

3d•Hybrid

About The Position

Kalles Group is hiring an Entra ID Engineer Consultant to work on assignment with an enterprise client, helping lead a large workforce identity migration from a legacy identity provider to Microsoft Entra ID. The role owns the design, implementation, and operation of access management and identity governance, supporting authentication for thousands of applications, including complex SAML integrations. It has substantial autonomy and includes setting engineering standards and mentoring other engineers. The work covers Conditional Access and authentication strategy, including phishing-resistant MFA and passwordless methods; Privileged Identity Management; application SSO and provisioning; B2B access; and the Entra ID Governance suite, including entitlement management, access reviews, and lifecycle workflows. The engineer will coordinate Entra-native governance with SailPoint Identity Security Cloud and hybrid Active Directory, and automate through Microsoft Graph, PowerShell, and infrastructure-as-code tools. The position is hybrid, with onsite requirements at the client’s Seattle, Washington location. Candidates must already live in the Seattle area. The annual salary range is $135,000–$155,000. Kalles Group offers medical, dental, and vision plans, a 401(k) with matching, and PTO for salaried employees, and emphasizes manageable workloads and work/life balance.

Requirements

Bachelor’s or master’s degree in computer science, cybersecurity, IT, or equivalent experience.
At least 4 years of IAM or security engineering experience, with a track record of leading technical projects.
Deep hands-on Microsoft Entra ID experience, including Conditional Access, authentication methods, PIM, and Entra ID Protection.
Hands-on Entra ID Governance experience, including entitlement management/access packages, access reviews, and lifecycle workflows.
Expert knowledge of SAML, OAuth 2.0, OIDC, and SCIM, including their security implications.
Hybrid identity experience with Entra Connect or Cloud Sync and on-premises Active Directory, including governing access across both.
Experience automating Entra through Microsoft Graph API or Graph PowerShell SDK, with PowerShell and Python, and Terraform or Bicep.
System-level design thinking and ability to set standards for other engineers.
Clear communication with engineers and stakeholders, and ability to work autonomously in a fast-paced environment.
Currently living in the Seattle area, due to onsite requirements at the client’s Seattle location.

Nice To Haves

Certifications such as SC-300, SC-100, AZ-500, CISSP, or SailPoint.
Experience with Entra governance alongside an enterprise IGA platform such as SailPoint IdentityNow or Identity Security Cloud.
PAM familiarity, such as BeyondTrust, and understanding of how PAM and PIM complement each other.
Experience with external/B2B identity at scale, cross-tenant collaboration, and guest governance.
ITDR exposure and experience feeding identity signals into SIEM/SOAR.
Experience with Entra Verified ID, Permissions Management, or Global Secure Access.
Experience in large-scale retail, ecommerce, or high-transaction enterprise environments.

Responsibilities

Design and maintain Conditional Access architecture, including persona- and risk-based policies, device and location conditions, session controls, and Authentication Strengths for phishing-resistant MFA.
Own authentication-method strategy and rollout, including passwordless/FIDO2/passkeys, Windows Hello for Business, and certificate-based authentication, and retire weaker methods.
Administer Privileged Identity Management, including eligible assignments, just-in-time activation, approvals, and privileged-role and PIM-for-groups reviews.
Manage application access, including enterprise application SSO using SAML/OIDC, app-role assignments, and SCIM provisioning.
Design external identity and B2B controls, including cross-tenant access settings, guest governance, and partner access patterns.
Build and operate Entitlement Management, including access packages, catalogs, policies, approval and expiration workflows, and separation-of-duties checks.
Design and conduct Access Reviews across groups, applications, privileged roles, and guests, including recurring or automated reviews with auto-remediation.
Implement lifecycle workflows for HR-driven joiner, mover, and leaver processes and scheduled governance tasks.
Configure HR-driven inbound provisioning and outbound SCIM application provisioning.
Integrate Entra-native governance with SailPoint Identity Security Cloud and hybrid Active Directory, defining ownership boundaries and avoiding duplicate controls.
Automate and manage configuration as code using PowerShell, Microsoft Graph API or Graph PowerShell SDK, and Terraform or Bicep.
Produce reference designs, standards, and documentation, and review other engineers’ designs and configurations.
Partner with SecOps so identity telemetry supports threat detection.
Mentor engineers and serve as the Entra access and governance subject-matter expert.
Use AI tooling to accelerate design and documentation.