Principal Engineer, Identity & Access Management (IAM) - Microsoft Entra ID

Boston Scientific • Arden Hills, MN

3d • $102,100 - $194,000 • Hybrid

About The Position

Boston Scientific is seeking a principal-level individual contributor specializing in Microsoft Entra ID and cloud identity to provide enterprise technical leadership in the architecture, security, engineering, and modernization of global identity services. The role establishes technical direction, architectural standards, and engineering practices for identity services supporting corporate IT, cloud platforms, manufacturing operations, operational technology, customer-facing applications, and Digital Health solutions. It leads complex engineering initiatives, resolves critical identity challenges, and influences enterprise technology decisions while advancing security, resilience, and operational excellence. The position works across cybersecurity, infrastructure, cloud, enterprise architecture, Digital Health, application development, manufacturing, and customer identity teams.

The role may be based in Arden Hills, Minnesota, or Marlborough, Massachusetts, and follows a hybrid model requiring at least three days per week in a local office. Visa sponsorship and relocation assistance are not available. Boston Scientific describes its culture as diverse and high-performing, with opportunities to access tools, information, and training to support career development.

Requirements

• Bachelor’s degree in computer science, information technology, engineering, cybersecurity, or a related field.
• At least 7 years of experience in identity and access management, cloud identity engineering, cybersecurity architecture, or a related technical discipline.
• Hands-on experience designing, engineering, and securing Microsoft Entra ID environments in complex, large-scale enterprises.
• Advanced expertise in Microsoft Entra ID, Conditional Access, MFA, passwordless authentication, enterprise applications, PIM, and cloud identity architecture.
• Strong knowledge of SAML, OAuth 2.0, OpenID Connect, Microsoft Graph, Azure RBAC, service principals, managed identities, and workload identities.
• Experience designing and securing enterprise application integrations, external identity solutions, cross-tenant access, and cloud identity services.
• Experience automating identity infrastructure and engineering processes using PowerShell, Microsoft Graph APIs, REST APIs, Terraform, or comparable technologies.
• Deep understanding of Zero Trust architecture, least privilege, privileged identity security, identity tiering, and modern authentication security principles.
• Experience establishing identity logging, monitoring, auditing, and operational security controls for enterprise identity platforms.
• Demonstrated ability to define technical architecture, establish engineering standards, and lead complex cross-functional initiatives across multiple technology organizations.
• Advanced troubleshooting and problem-solving skills across identity, authentication, federation, authorization, and cloud environments.
• Ability to evaluate identity solutions from cybersecurity, operational resilience, scalability, and business continuity perspectives.
• Strong communication and technical leadership skills, including influencing architectural decisions, translating business requirements into engineering solutions, and mentoring engineers without direct reporting authority.

Nice To Haves

• Experience with on-premises Microsoft Active Directory and hybrid AD/Entra architectures, including synchronization, authentication dependencies, security boundaries, and privileged identity considerations.
• Knowledge of Active Directory security, administrative tiering, Tier 0 protection, and directory hardening.
• Experience delivering IAM or cybersecurity solutions in medical device manufacturing, healthcare, pharmaceutical, manufacturing, or other highly regulated environments.
• Experience designing secure identity architectures for manufacturing systems and operational technology environments.
• Knowledge of IT/OT security architecture, network segmentation, legacy-system integration, high-availability manufacturing environments, and hybrid identity dependencies.
• Experience integrating Microsoft Entra ID with CyberArk, Saviynt, or comparable privileged access management and identity governance platforms.
• Experience with Splunk or comparable SIEM technologies for identity monitoring, auditing, security detection, and investigation.
• Advanced experience with Microsoft Entra External ID, B2B collaboration, Entitlement Management, Identity Protection, workload identities, and cross-tenant access.
• Experience supporting authentication and identity integration for customer-facing applications, Digital Health platforms, partner ecosystems, or CIAM environments.
• Familiarity with IAM and security technologies such as Yubico, DigiCert, 1Password, Ping Identity, or CrowdStrike Falcon Identity.
• Knowledge of the NIST Cybersecurity Framework, NIST SP 800-82, IEC 62443, and Zero Trust principles.
• Relevant Microsoft identity, cloud architecture, or cybersecurity certifications.

Responsibilities

• Define and drive enterprise architecture, technical strategy, and the engineering roadmap for Microsoft Entra ID and cloud identity services across a complex global environment.
• Serve as a principal technical authority for Microsoft Entra ID, authentication, authorization, federation, and cloud identity architecture, guiding complex technical decisions and enterprise integration patterns.
• Architect and advance identity security controls, including Conditional Access, MFA, passwordless authentication, Identity Protection, PIM, and Zero Trust principles.
• Establish secure administrative and privileged identity models aligned with least privilege, identity tiering, privileged access protection, and cybersecurity standards.
• Define secure integration standards between Microsoft Entra ID and on-premises Active Directory, partnering with directory engineering teams on hybrid identity dependencies and security boundaries.
• Lead design of secure identity and authentication solutions for corporate IT, cloud platforms, and manufacturing/OT environments while balancing cybersecurity, resilience, availability, and business continuity.
• Establish integration standards for SSO, SAML, OAuth 2.0, OpenID Connect, application registrations, API permissions, service principals, managed identities, and workload identities.
• Partner with Digital Health, CIAM, and application teams on authentication and authorization architectures for customer-facing applications, partner access, and external identity solutions.
• Define secure integration patterns across Microsoft Entra ID, Saviynt, CyberArk, and the broader enterprise IAM ecosystem.
• Establish engineering standards for Azure RBAC, external identities, B2B collaboration, cross-tenant access, privileged cloud identities, and emergency access.
• Drive engineering automation and infrastructure modernization using Microsoft Graph, PowerShell, REST APIs, Terraform, and infrastructure as code.
• Define identity logging, monitoring, auditing, and telemetry requirements, partnering with Security Operations to integrate identity signals into SIEM platforms such as Splunk.
• Lead technical design reviews, root-cause investigations, identity resilience and recovery initiatives, and strategic platform modernization.
• Serve as a senior technical escalation point for identity, authentication, federation, authorization, and cloud security challenges, driving sustainable solutions.
• Establish and govern engineering standards, architectural documentation, operating procedures, configuration baselines, technical runbooks, and troubleshooting practices.
• Identify systemic platform risks, technical debt, and opportunities for automation, continuous improvement, and operational efficiency.
• Influence cross-functional architectural decisions, communicate technical risks and trade-offs, and align engineering solutions with cybersecurity and business objectives.
• Mentor IAM engineers through architectural guidance, technical design reviews, knowledge sharing, and hands-on coaching.

Benefits

• Core and optional employee benefits are offered; details are provided at www.bscbenefitsconnect.com.
• Compensation for exempt, non-sales roles may include an annual bonus target and long-term incentives, subject to plan eligibility and requirements.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal