Senior Identity Access Management Engineer

Charles River Associates•Boston, MA

3d•$130,000 - $152,500•Hybrid

About The Position

The Senior Identity Access Management Engineer designs, implements, and supports enterprise identity and access management solutions, primarily on Microsoft Entra. The role serves as a subject matter expert in identity security, privileged access management, identity governance, and non-human identities, supporting secure and compliant access across hybrid and cloud environments. It contributes to CRA’s hybrid cloud strategy through identity platform standardization, governance, and automation-first operational practices. The engineer advances Microsoft security best practices and modern identity architectures using Microsoft Entra ID, Entra ID Governance, Privileged Identity Management (PIM), Conditional Access, Identity Protection, and related services. The role involves coordination with other IT teams and the wider firm, travel to CRA offices, and some out-of-hours and weekend work for scheduled upgrades or unexpected outages. CRA’s Information Technology team is a global team of 40 professionals working across service delivery and telecom, enterprise application solutions, infrastructure, networking and cloud services, and security. CRA is primarily a Microsoft environment and seeks to optimize on-premises systems and hybrid infrastructure. The position is expected to work in an office at least 3 to 4 days per week, which may include travel to another CRA office or client meetings; specific days are coordinated with the practice or team.

Requirements

Bachelor’s degree in Computer Science, Information Systems, or a related discipline.
8–10 years of hands-on professional experience, with the most recent years as an IAM Engineer.
Proven experience designing, deploying, and managing an enterprise PAM environment, with specialized knowledge of Thycotic, CyberArk, or Microsoft privileged access solutions.
Experience automating identity lifecycle processes using PowerShell, Microsoft Graph API, Azure Automation, Logic Apps, or related platforms.
Experience implementing and supporting Microsoft Entra ID, Entra ID Governance, Privileged Identity Management (PIM), and Conditional Access policies in enterprise-scale environments.
Hands-on experience with hybrid identity architectures, including Active Directory Domain Services (AD DS), Entra Connect, Cloud Sync, and federated authentication services.
Experience implementing and managing SSO integrations using SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), and SCIM.
Demonstrated ability to remove standing privilege using just-in-time access or other dynamic elevation models.
Hands-on experience with cloud migrations while managing complex hybrid Active Directory environments.
Knowledge of regulatory and security frameworks, including NIST, CIS Controls, ISO 27001, and Zero Trust security standards.
Comfort with customer-facing scenarios and effective collaboration in cross-functional technical teams.
Self-motivation and the ability to prioritize and execute tasks in a high-pressure environment.
Ability to travel to other offices and execute project plans with minimal oversight.

Nice To Haves

Master’s degree in Computer Science, Information Systems, or a related discipline.
Experience with VMware Cloud Foundation (VCF), vSphere, and hybrid cloud architectures.
Microsoft Certified: Identity and Access Administrator Associate (SC-300), Azure Solutions Architect Expert (AZ-305), or related cloud identity certifications.
Experience with Identity Threat Detection and Response (ITDR), identity security monitoring, and integrations with Microsoft Defender and Microsoft Sentinel.
Experience integrating AIOps, observability, or monitoring platforms.

Responsibilities

Design, implement, and maintain enterprise identity solutions across Microsoft Entra ID, Active Directory, and hybrid identity environments.
Architect secure authentication and authorization services using Entra ID, Conditional Access, Identity Protection, MFA, and Privileged Identity Management.
Develop and maintain automation solutions using PowerShell, Azure REST APIs, Graph, and JWT tokens.
Automate identity provisioning, deprovisioning, access certification, credential rotation, and governance processes.
Create integrations with enterprise systems to improve identity operations and reduce manual administration.
Provide operational support for Microsoft Entra and Active Directory services, ensuring availability, reliability, and security.
Monitor, troubleshoot, and resolve complex identity, authentication, synchronization, and access-related issues.
Collaborate with Cloud, Infrastructure, Security, and Application teams to onboard and secure enterprise applications.
Establish and maintain identity security standards, operational procedures, and access control policies.
Support audit, compliance, and regulatory requirements through effective identity governance and privileged access controls.
Identify and remediate identity-related risks in alignment with Zero Trust and Microsoft security best practices.
Coordinate across IT and the firm, travel to CRA offices as needed, and perform some out-of-hours and weekend work for scheduled upgrades and unexpected outages.

Benefits

Comprehensive benefits package, subject to eligibility requirements.
Medical, dental, and vision insurance.
401(k) retirement plan with employer match.
Life and disability insurance.
Paid time off, including vacation, sick leave, and holidays.
Paid parental leave.
Wellness programs and employee assistance resources.
Commuter benefits.
Wellness programming supporting physical, mental, emotional, and financial well-being.
In-house immigration support for foreign nationals and international business travelers.
Skills development programs, including technical training, presentation skills, internal seminars, career mentoring, and performance coaching.
Additional leadership and collaboration opportunities through internal firm development activities.
Eligibility for additional bonus incentive compensation.