Principal Microsoft Entra ID Architect

Unisys•Blue Bell, PA

About The Position

Unisys is seeking a highly skilled Security Architect with deep Microsoft Entra ID expertise to lead the design, implementation, and governance of company Entra ID tenants. The role advances the corporate strategy to reduce reliance on Active Directory by adopting secure, cloud-based identity capabilities in Microsoft Entra ID. It also provides senior security architecture and strategic guidance to keep corporate Active Directory environments secure, resilient, operationally sound, and appropriately integrated during the transition. This hands-on position combines technical depth, architectural leadership, and delivery focus, with identity configurations and practices aligned to Zero Trust principles, corporate security policies, and industry best practices. The architect defines and maintains enterprise identity architecture, tenant baselines, and target-state roadmaps. The role governs roles, permissions, consent, application access reviews, Conditional Access, identity lifecycle automation, authentication, and application integrations. It includes monitoring identity activity and designing tenant disaster recovery and secure management of application secrets and certificates. For Active Directory, the role provides senior architectural direction and escalation support, particularly for the production environment, while partnering with established engineering and operations teams rather than assuming day-to-day operational ownership. The architect guides hybrid identity integration, resilience, security, and modernization efforts, assesses legacy dependencies and risks, and coordinates remediation across security, engineering, operations, governance, leadership, and business teams. The position also tracks and communicates initiative progress, dependencies, risk reduction, and business impact, and stays current on identity threats, Microsoft capabilities, regulations, and industry practices.

Requirements

Bachelor of Arts/Bachelor of Science degree and 8+ years of relevant experience, or an equivalent combination of education and experience.
At least 5 years with a primary focus on Microsoft Azure/Entra ID.
Demonstrated engineering or architectural experience with Microsoft Entra ID, Active Directory, and hybrid identity environments.
Experience implementing Conditional Access, MFA, identity protection, and PIM.
Hands-on experience with Entra Connect, Cloud Sync, federation, SSO, and application integrations.
Experience securing application registrations, service principals, and enterprise applications in single-tenant and multi-tenant environments.
Deep expertise in Microsoft Entra ID, including Conditional Access, directory configuration, roles and permissions, and PIM.
Proven expertise in PowerShell, Graph API, and automation, including creating and modifying scripts for configuration and access reporting.
Strong understanding of modern authentication protocols, including SAML, OAuth 2.0, OpenID Connect, Kerberos, and LDAP.
Experience with Microsoft Graph API application and delegated permissions, including how they apply and secure assignment methods.

Nice To Haves

10 or more years of related experience.
Master’s degree.

Responsibilities

Design and govern corporate Microsoft Entra ID tenant configurations, directory baselines, roles, permissions, and consent management.
Enforce least privilege through delegated and application permission models, automated consent review and approval workflows, and application access reviews.
Implement tenant disaster recovery and recoverability using cost-effective methods.
Securely manage application secrets and certificates, integrating with corporate PKI and Azure Key Vault.
Design and enforce Conditional Access policies using user, location, device, and risk signals in coordination with the security team.
Conduct threat modeling and risk assessments for authentication and authorization flows.
Monitor application and service principal activity using Microsoft Sentinel, Azure Monitor, and Entra ID audit logs.
Lead adoption of modern authentication, including OAuth, OIDC, SAML, FIDO2, and passwordless authentication.
Implement identity lifecycle automation using Entra ID Governance, Privileged Identity Management, and Access Reviews.
Deploy and manage Entra Connect, Cloud Sync, federation, and SSO configurations.
Integrate third-party SaaS and internal applications with Entra ID for SSO and SCIM provisioning.
Support rollout of MFA, passwordless authentication, and secure sign-in enhancements.
Provide senior security architecture and strategic direction for corporate Active Directory environments, particularly production environments.
Define and govern enterprise Active Directory architecture, security, privileged access, resilience, and operational standards.
Partner with Active Directory engineering and operations teams to maintain secure, resilient, operationally sound, and recoverable directory services.
Architect and oversee secure integration between Active Directory and Microsoft Entra ID across hybrid identity services.
Advance modernization and transition of appropriate identity capabilities from Active Directory to Microsoft Entra ID.
Assess architectural risks and legacy dependencies, guide remediation and dependency-reduction initiatives, and provide senior escalation for complex or high-risk decisions.
Develop scalable Entra ID target-state architectures and prioritized roadmaps balancing security, availability, operational supportability, cost, and business requirements.
Analyze systemic identity risks and integration challenges across cloud and hybrid environments and translate findings into remediation and modernization strategies.
Align security, engineering, operations, governance, leadership, and business-unit teams on identity standards and material risks.
Track and communicate progress, dependencies, risk reduction, and business impact for major Entra ID and related Active Directory initiatives.
Stay current on identity-based threats, Microsoft security capabilities, regulatory requirements, and industry practices to guide identity security strategy.