Security Analyst - Identity and Access Management

EMCOR Group•AZ-Phoenix US-AZ-Phoenix US-NV-Las Vegas, AZ

About The Position

The Security Analyst for Identity and Access Management (IAM) supports EMCOR’s Security Program by administering identity systems, including single sign-on (SSO), privileged access management (PAM), and user lifecycle management. The role focuses primarily on Microsoft Sentinel and Microsoft Defender, using Kusto Query Language (KQL) to improve threat detection, automate response, and strengthen the organization’s security posture in support of SOC operations and Identity Threat Detection and Response (ITDR). The position also supports enterprise information security operations, manages IAM product operations, administers Entra ID, and deploys and maintains systems for user lifecycle, access governance, and PAM. The Security Analyst collaborates with security and IT teams, maintains and upgrades supporting servers and applications, and may perform special projects as needed.

Requirements

At least five years of experience with Microsoft Active Directory, preferably in a multi-domain environment.
At least three years of experience working with Microsoft Entra ID.
At least two years of experience using the Microsoft Defender Platform and/or Microsoft Sentinel.
At least one year of experience with Privileged Access Management systems.
Proficiency in PowerShell for administration and automation.
Practical experience and/or comprehensive understanding of one or more of the following: MFA, SSO, SAML, OAuth, OpenID, SCIM, and REST API.
Ability to communicate effectively and interact professionally with personnel at all organizational levels.
Strong project management capabilities.
Ability to consistently deliver an exceptional standard of customer service.

Responsibilities

Provide subject-matter expertise during security incidents, document findings, and recommend improvements to incident response protocols.
Design, implement, and maintain Microsoft Sentinel and Microsoft Defender monitoring, including developing and tuning custom KQL queries and automation to enhance detection and response.
Monitor emerging threats and advise stakeholders on responses.
Investigate and resolve IAM security incidents using established tools and procedures.
Support and monitor the enterprise information security system as directed by management.
Manage daily operations and support for IAM products, including incident and ticket resolution.
Administer Entra ID, including SSO, Conditional Access, and modern authentication methods.
Deploy and maintain IAM systems for user lifecycle, access governance, and PAM.
Collaborate with security and IT teams to enhance IAM maturity and awareness.
Maintain and upgrade servers and applications supporting security tools.
Perform special projects as needed.
Support and maintain EMCOR’s Security Program.