Principal Engineer, Identity & Access Management (IAM) - Microsoft Entra ID

Boston Scientific • Marlborough, MA

3d • Hybrid

About The Position

Boston Scientific is seeking a Principal Engineer, Identity & Access Management (IAM), specializing in Microsoft Entra ID and cloud identity to provide enterprise-level technical leadership in the architecture, security, engineering, and modernization of global identity services. As a principal-level individual contributor, this role establishes technical direction, architectural standards, and engineering best practices for cloud identity services supporting corporate IT, cloud platforms, manufacturing operations, and operational technology (OT) environments. The role also enables secure identity integration with customer-facing applications and Digital Health solutions.

This hands-on technical leadership position requires deep expertise in Microsoft Entra ID, modern authentication, identity security, and cloud architecture. The engineer will lead complex engineering initiatives, resolve critical identity challenges, and influence enterprise technology decisions while advancing platform security, resilience, and operational excellence. The role collaborates with cybersecurity, infrastructure, cloud, enterprise architecture, Digital Health, application development, manufacturing, and customer identity teams.

The position may be based in Arden Hills, Minnesota, or Marlborough, Massachusetts, and follows a hybrid model requiring at least three days per week in a local office. Visa sponsorship and relocation assistance are not available.

Requirements

• Bachelor's degree in computer science, information technology, engineering, cybersecurity, or a related field.
• At least 7 years of experience in identity and access management, cloud identity engineering, cybersecurity architecture, or a related technical discipline.
• Hands-on experience designing, engineering, and securing Microsoft Entra ID environments in complex, large-scale enterprises.
• Advanced expertise in Microsoft Entra ID, Conditional Access, MFA, passwordless authentication, enterprise applications, PIM, and cloud identity architecture.
• Strong knowledge of modern authentication and authorization technologies, including SAML, OAuth 2.0, OpenID Connect, Microsoft Graph, Azure RBAC, service principals, managed identities, and workload identities.
• Demonstrated experience designing and securing enterprise application integrations, external identity solutions, cross-tenant access, and cloud identity services.
• Experience automating identity infrastructure and engineering processes using PowerShell, Microsoft Graph APIs, REST APIs, Terraform, or comparable technologies.
• Deep understanding of Zero Trust architecture, least privilege, privileged identity security, identity tiering, and modern authentication security principles.
• Experience establishing identity logging, monitoring, auditing, and operational security controls for enterprise identity platforms.
• Ability to define technical architecture, establish engineering standards, and lead complex cross-functional initiatives across multiple technology organizations.
• Advanced troubleshooting and problem-solving skills across identity, authentication, federation, authorization, and cloud environments.
• Ability to evaluate identity solutions from cybersecurity, operational resilience, scalability, and business continuity perspectives.
• Strong communication and technical leadership skills, including the ability to influence architectural decisions, translate business requirements into engineering solutions, and mentor engineers without direct reporting authority.

Nice To Haves

• Experience with on-premises Microsoft Active Directory and hybrid AD/Entra identity architectures, including synchronization, authentication dependencies, security boundaries, and privileged identity considerations.
• Knowledge of Active Directory security, administrative tiering, Tier 0 protection, and directory hardening.
• Experience delivering IAM or cybersecurity solutions in medical device manufacturing, healthcare, pharmaceutical, manufacturing, or other highly regulated environments.
• Experience designing secure identity architectures for manufacturing systems and operational technology environments.
• Knowledge of IT/OT security architecture, network segmentation, legacy-system integration, high-availability manufacturing environments, and hybrid identity dependencies.
• Experience integrating Microsoft Entra ID with CyberArk, Saviynt, or comparable privileged access management and identity governance platforms.
• Experience with Splunk or comparable SIEM technologies for identity monitoring, auditing, security detection, and investigation.
• Advanced experience with Microsoft Entra External ID, B2B collaboration, Entitlement Management, Identity Protection, workload identities, and cross-tenant access.
• Experience supporting authentication and identity integration for customer-facing applications, Digital Health platforms, partner ecosystems, or CIAM environments.
• Familiarity with IAM and security technologies such as Yubico, DigiCert, 1Password, Ping Identity, or CrowdStrike Falcon Identity.
• Knowledge of cybersecurity frameworks and standards, including the NIST Cybersecurity Framework, NIST SP 800-82, IEC 62443, and Zero Trust principles.
• Relevant Microsoft identity, cloud architecture, or cybersecurity certifications.

Responsibilities

• Define and drive the enterprise architecture, technical strategy, and engineering roadmap for Microsoft Entra ID and cloud identity services across a complex global environment.
• Serve as a principal technical authority for Microsoft Entra ID, authentication, authorization, federation, and cloud identity architecture, guiding complex technical decisions and enterprise integration patterns.
• Architect and advance identity security controls, including Conditional Access, multifactor authentication, passwordless authentication, Identity Protection, Privileged Identity Management (PIM), and Zero Trust principles.
• Establish secure administrative and privileged identity models aligned with least privilege, identity tiering, privileged access protection, and enterprise cybersecurity standards.
• Define standards and integration patterns between Microsoft Entra ID and on-premises Active Directory, partnering with directory engineering teams on hybrid identity dependencies and security boundaries.
• Design secure identity and authentication solutions for corporate IT, cloud platforms, and manufacturing/OT environments while balancing cybersecurity, resilience, availability, and business continuity.
• Establish enterprise integration standards for SSO, SAML, OAuth 2.0, OpenID Connect, application registrations, API permissions, service principals, managed identities, and workload identities.
• Partner with Digital Health, CIAM, and application teams on authentication and authorization architectures for customer-facing applications, partner access, and external identity solutions.
• Define secure integration patterns across Microsoft Entra ID, Saviynt, CyberArk, and the broader enterprise IAM ecosystem.
• Establish standards for Azure RBAC, external identities, B2B collaboration, cross-tenant access, privileged cloud identities, and emergency access.
• Drive engineering automation and infrastructure modernization using Microsoft Graph, PowerShell, REST APIs, Terraform, and infrastructure-as-code technologies.
• Define identity logging, monitoring, auditing, and telemetry requirements, partnering with Security Operations to integrate identity security signals into SIEM platforms, including Splunk.
• Lead technical design reviews, root-cause investigations, identity resilience and recovery initiatives, and strategic platform modernization efforts.
• Act as a senior technical escalation point for complex identity, authentication, federation, authorization, and cloud security challenges, driving sustainable solutions.
• Establish and govern engineering standards, architectural documentation, operating procedures, configuration baselines, technical runbooks, and troubleshooting practices.
• Identify systemic platform risks, technical debt, and opportunities for automation, continuous improvement, and operational efficiency.
• Influence cross-functional architectural decisions, communicate technical risks and trade-offs, and align engineering solutions with cybersecurity and business objectives.
• Mentor IAM engineers through architectural guidance, design reviews, knowledge sharing, and hands-on coaching.

Benefits

• Core and optional employee benefits are offered; details are available at www.bscbenefitsconnect.com.
• Exempt, non-sales roles may be eligible for an annual bonus target and long-term incentives, subject to plan eligibility and other requirements.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal