Identity Operations Engineer Consultant - Access Lifecycle & Automation

Kalles Group•Seattle, WA

17d•Hybrid

About The Position

As an Identity Operations Engineer with Kalles Group, you will work on assignment with an enterprise client, supporting workforce, partner, and contractor access across Microsoft Entra ID and SailPoint Identity Security Cloud as the client migrates application authentication from a legacy identity provider to Entra. This is a hands-on operations role focused primarily on processing identity tickets, including joiner/mover/leaver events, access requests, provisioning and hybrid synchronization failures, privileged access, access certifications, and SOX and PCI audit evidence. You will also automate recurring work using PowerShell, Microsoft Graph, SailPoint ISC APIs, and workflow tools such as Logic Apps, Power Automate, and Azure Automation or Functions, integrated with the ITSM platform. You will act as an escalation point when access issues occur and partner with Identity Architecture, HR, ITSM, application owners, and Security Operations to resolve issues and prevent recurrence. The position is hybrid in Seattle, Washington, with onsite requirements at the client location. After-hours support may be needed. Kalles Group describes its mission as helping secure the future for companies and emphasizes trust, relationships, integrity, purposeful service, ownership, continuous learning, and a manageable workload.

Requirements

Bachelor's or master's degree in computer science, cybersecurity, information technology, or equivalent experience.
At least 3 years of experience in IAM, IAM operations, or systems/security engineering, including hands-on joiner/mover/leaver processes.
Hands-on Entra ID user, group, and application administration; working knowledge of Conditional Access, PIM, and Entra ID Governance features including Lifecycle Workflows, Entitlement Management, and Access Reviews.
Hands-on enterprise IGA operations experience; SailPoint ISC/IdentityNow is preferred, while comparable IGA experience is considered. Experience should include access requests, provisioning, source connectors, and troubleshooting.
PowerShell and Microsoft Graph API or Graph PowerShell SDK experience.
Working knowledge of SAML, OAuth 2.0, OIDC, and SCIM sufficient to troubleshoot SSO and provisioning.
Hybrid identity experience with on-premises AD and Entra Connect or Cloud Sync, including synchronization and attribute troubleshooting.
ITSM ticketing experience, such as ServiceNow, including queue management against SLAs and documentation to audit standards.
Strong troubleshooting skills, attention to detail, and clear communication with technical and non-technical partners.

Nice To Haves

Certifications such as SC-300, SailPoint ISC, AZ-500, Security+, or CISSP.
Python and REST API integration experience.
ITSM-integrated automation, such as ServiceNow-to-SailPoint or Entra fulfillment.
Low-code automation experience with Power Automate or Logic Apps and infrastructure-as-code or configuration-as-code experience with Terraform or Bicep.
HRIS-driven provisioning experience, such as Workday, and source-of-truth data quality experience.
PAM familiarity, such as BeyondTrust, and understanding of PAM/PIM interplay.
Audit and compliance support experience for access controls and evidence, including SOX and PCI.
ITDR exposure and experience integrating identity signals into SIEM/SOAR.
Experience in large-scale retail, ecommerce, or high-transaction enterprise environments.

Responsibilities

Fulfill joiner, mover, and leaver requests from the ITSM queue within SLA, including account creation, baseline and role-based access, transfers, promotions, and timely deprovisioning.
Operate SailPoint Identity Security Cloud, including access requests, provisioning failures, aggregations, identity refreshes, source-data and attribute fixes, and role and access profile assignments.
Administer Entra ID users, groups, licensing, enterprise app role assignments, guests, Lifecycle Workflows, and Entitlement Management requests.
Troubleshoot HR-to-identity provisioning and hybrid synchronization issues, including attribute mismatches and duplicate or conflicting accounts.
Handle privileged and elevated access, including PIM-eligible assignments and role-assignable groups, with approvals and audit trails.
Support application access, including SSO assignments, SCIM troubleshooting, and onboarding applications and connectors to established patterns.
Operate access certification and review campaigns and produce SOX and PCI audit evidence.
Perform account hygiene, including orphaned, dormant, and stale account checks, guest cleanup, service account inventory, and Entra, SailPoint, and AD reconciliation.
Build lifecycle and access automation using PowerShell, Graph API or Graph PowerShell SDK, Python, SailPoint ISC APIs, workflows, and rules.
Develop event-driven and scheduled workflows using Azure Automation, Logic Apps, Power Automate, and Azure Functions, including ITSM ticket auto-fulfillment and closure.
Analyze ticket volume, SLAs, and failure patterns to identify automation opportunities and track tickets eliminated, time saved, and error reduction.
Maintain automation as production code with source control, peer review, testing, logging, and error handling; use AI tooling to accelerate scripting and troubleshooting.
Write runbooks, SOPs, and knowledge base articles and serve as an escalation point for service desk and application teams.
Partner with HR/HRIS, ITSM, and Security Operations on data quality, lifecycle timing, and identity signals.
Participate in identity incident response, including after-hours support as needed.