Identity Operations Engineer Consultant - Access Lifecycle & Automation

Kalles Group•Seattle, WA

17d•$120,000 - $140,000•Hybrid

About The Position

Kalles Group is hiring an Identity Operations Engineer Consultant to support an enterprise client’s workforce, partner, and contractor access across Microsoft Entra ID and SailPoint Identity Security Cloud. The client is moving application authentication from a legacy identity provider to Entra. This hands-on operations role focuses primarily on identity ticket-queue work, including joiner/mover/leaver events, access requests, provisioning and hybrid synchronization failures, privileged access, access certifications, and audit evidence for SOX and PCI. The role also automates repetitive work using PowerShell, Microsoft Graph, SailPoint ISC APIs, and workflow tools integrated with the ITSM platform. The engineer is an escalation point for access issues and partners with Identity Architecture, HR, ITSM, application owners, and Security Operations to resolve problems and prevent recurrence. The position is hybrid, with onsite requirements at the client’s Seattle, Washington location, and after-hours support as needed. Candidates must already live in the Seattle area. Kalles Group describes its values as integrity, purposefulness, and ownership, and emphasizes trust, relationship-building, continuous learning, and a manageable workload. The annual salary range is $120,000–$140,000. Benefits listed are medical, dental, and vision plans, a 401(k) with matching, and PTO for salaried employees.

Requirements

Bachelor’s or master’s degree in Computer Science, Cybersecurity, IT, or equivalent experience.
At least 3 years of experience in IAM, IAM operations, or systems/security engineering, including hands-on joiner/mover/leaver processes.
Hands-on Entra ID user, group, and application administration; working knowledge of Conditional Access, PIM, and Entra ID Governance features, including Lifecycle Workflows, Entitlement Management, and Access Reviews.
Hands-on enterprise IGA operations experience; SailPoint ISC/IdentityNow is preferred, and comparable IGA experience is considered. Experience should include access requests, provisioning, source connectors, and troubleshooting.
PowerShell and Microsoft Graph API or Graph PowerShell SDK experience.
Working knowledge of SAML, OAuth 2.0, OIDC, and SCIM sufficient to troubleshoot SSO and provisioning.
Hybrid identity knowledge, including on-premises Active Directory and Entra Connect or Cloud Sync, with synchronization and attribute troubleshooting.
ITSM ticketing experience, such as ServiceNow, including queue management against SLAs and documentation to audit standards.
Strong troubleshooting skills, attention to detail, and clear communication with technical and non-technical partners.
Must already live in the Seattle area.

Nice To Haves

Python and REST API integration experience.
Certifications such as SC-300, SailPoint ISC, AZ-500, Security+, or CISSP.
ITSM-integrated automation, such as ServiceNow-to-SailPoint or Entra fulfillment.
Low-code automation experience with Power Automate or Logic Apps.
Infrastructure as code or configuration as code experience with Terraform or Bicep.
HRIS-driven provisioning experience, such as Workday, and source-of-truth data quality experience.
PAM familiarity, such as BeyondTrust, and knowledge of PAM/PIM interplay.
Audit and compliance support for access controls and evidence, including SOX and PCI.
ITDR exposure and experience integrating identity signals into SIEM/SOAR.
Large-scale retail, ecommerce, or high-transaction enterprise experience.

Responsibilities

Fulfill joiner, mover, and leaver requests from the ITSM queue within SLA, including account creation, baseline and role-based access, transfers, promotions, and timely deprovisioning.
Operate SailPoint ISC, handling access requests, provisioning failures, aggregations, identity refreshes, attribute and source-data fixes, and role and access-profile assignments.
Administer Entra ID users, groups, licensing, enterprise application role assignments, guests, Lifecycle Workflows, and Entitlement Management requests.
Troubleshoot HR-to-identity provisioning and hybrid synchronization issues, including attribute mismatches and duplicate or conflicting accounts.
Handle privileged and elevated access, including PIM-eligible assignments and role-assignable groups, with approvals and audit trails.
Support application access, including SSO assignments, SCIM troubleshooting, and onboarding applications and connectors to established patterns.
Run access certification and review campaigns operationally and produce SOX and PCI audit evidence.
Maintain account hygiene by addressing orphaned, dormant, and stale accounts; cleaning up guests; maintaining service-account inventories; and reconciling Entra, SailPoint, and Active Directory.
Build lifecycle and access automation using PowerShell, Graph API or Graph PowerShell SDK, Python, SailPoint ISC APIs, workflows, and rules.
Create event-driven or scheduled workflows using Azure Automation, Logic Apps, Power Automate, and Azure Functions, including ITSM ticket auto-fulfillment and closure.
Analyze ticket volume, SLAs, and failure patterns to identify automation opportunities and track tickets eliminated, time saved, and error reduction.
Develop automation as production code using source control, peer review, testing, logging, and error handling; use AI tooling to speed scripting and troubleshooting.
Write runbooks, SOPs, and knowledge-base articles, and serve as an escalation point for service desk and application teams.
Partner with HR/HRIS, ITSM, and Security Operations on data quality, lifecycle timing, and identity signals.
Participate in identity incident response, including after-hours support as needed.