Senior Identity Access Management Engineer

Charles River Associates•Chicago, TX

3d•$130,000 - $152,500•Hybrid

About The Position

The Senior Identity Access Management Engineer designs, implements, and supports enterprise identity and access management solutions, primarily on the Microsoft Entra platform. The role serves as the subject matter expert for identity security, privileged access management, identity governance, and non-human identities, supporting secure and compliant access across hybrid and cloud environments. It advances CRA’s hybrid cloud strategy through identity platform standardization, governance, and automation-first operational practices. The engineer helps drive adoption of Microsoft security best practices and modern identity architectures, using Microsoft Entra ID, Entra ID Governance, Privileged Identity Management, Conditional Access, Identity Protection, and related services. The role requires coordination with other IT teams and colleagues across the firm, travel to CRA offices, and some out-of-hours and weekend work for scheduled upgrades or unexpected outages. CRA’s global Information Technology team has 40 professionals and supports technology infrastructure and security across its offices. The role is primarily office-based, with an expectation of working in the office at least three to four days per week; office days may include travel to another CRA office or client meetings, and specific days are coordinated with the practice or team.

Requirements

Bachelor’s degree in Computer Science, Information Systems, or a related discipline; a master’s degree is desirable.
8–10 years of hands-on professional experience, with the most recent years as an IAM Engineer.
Experience designing, deploying, and managing an enterprise privileged access management environment, with specialized knowledge of Thycotic, CyberArk, or Microsoft privileged access solutions.
Experience automating identity lifecycle processes using PowerShell, Microsoft Graph API, Azure Automation, Logic Apps, or related platforms.
Experience implementing and supporting Microsoft Entra ID, Entra ID Governance, Privileged Identity Management, and Conditional Access policies in enterprise-scale environments.
Hands-on experience with hybrid identity architectures, including Active Directory Domain Services, Entra Connect, Cloud Sync, and federated authentication services.
Experience implementing and managing single sign-on integrations using SAML 2.0, OAuth 2.0, OpenID Connect, and SCIM.
Demonstrated ability to remove standing privileges using just-in-time access or other dynamic elevation models.
Hands-on experience with cloud migrations in complex hybrid Active Directory environments.
Knowledge of regulatory and security frameworks, including NIST, CIS Controls, ISO 27001, and Zero Trust security standards.
Comfort in customer-facing situations and ability to collaborate effectively in cross-functional technical teams.
Self-motivation and strong ability to prioritize and execute tasks in a high-pressure environment.
Ability to travel to other offices and execute project plans with minimal oversight.

Nice To Haves

Master’s degree in Computer Science, Information Systems, or a related discipline.
Experience with VMware Cloud Foundation, vSphere, and hybrid cloud architectures.
Microsoft Certified: Identity and Access Administrator Associate (SC-300), Azure Solutions Architect Expert (AZ-305), or related cloud identity certifications.
Experience with Identity Threat Detection and Response, identity security monitoring, and integrations with Microsoft Defender and Microsoft Sentinel.
Experience integrating AIOps, observability, or monitoring platforms.

Responsibilities

Design, implement, and maintain enterprise identity solutions across Microsoft Entra ID, Active Directory, and hybrid identity environments.
Architect secure authentication and authorization services using Entra ID, Conditional Access, Identity Protection, MFA, and Privileged Identity Management.
Develop and maintain automation using PowerShell, Azure REST APIs, Microsoft Graph, and JWT tokens.
Automate identity provisioning and deprovisioning, access certification, credential rotation, and governance processes.
Integrate enterprise systems to improve identity operations and reduce manual administration.
Provide operational support for Microsoft Entra and Active Directory services, ensuring availability, reliability, and security.
Monitor, troubleshoot, and resolve complex identity, authentication, synchronization, and access-related issues.
Collaborate with Cloud, Infrastructure, Security, and Application teams to onboard and secure enterprise applications.
Establish and maintain identity security standards, operational procedures, and access control policies.
Support audit, compliance, and regulatory requirements through identity governance and privileged access controls.
Identify and remediate identity-related risks in alignment with Zero Trust and Microsoft security best practices.
Coordinate with teams across IT and the firm, travel to other CRA offices, and perform scheduled or incident-related work outside regular hours as needed.

Benefits

Comprehensive benefits package, subject to eligibility requirements.
Medical, dental, and vision insurance.
401(k) retirement plan with employer match.
Life and disability insurance.
Paid time off, including vacation, sick leave, and holidays.
Paid parental leave.
Wellness programs and employee assistance resources.
Commuter benefits.
Wellness programming supporting physical, mental, emotional, and financial well-being.
In-house immigration support for foreign nationals and international business travelers.
Skills development, technical training, internal seminars, career mentoring, and performance coaching.
Additional leadership and collaboration opportunities through internal firm development activities.
Eligibility for additional bonus incentive compensation.