Microsoft Entra ID & Active Directory Engineer

Microsoft Entra ID (Advanced Implementation)

• Implement and optimize Conditional Access policies based on approved designs
• Support and operationalize:
• Risk‑based access policies
• Authentication Strengths and phishing‑resistant MFA
• Lead operational implementation of Privileged Identity Management (PIM):
• Role assignments
• Approval workflows
• Just‑in‑Time access configuration
• Secure application and workload identities:
• App registrations and service principals
• OAuth permission governance

On‑Prem Active Directory (Security & Hardening)

• Support and enforce AD security best practices:
• Tiered admin model (Tier 0 / 1 / 2)
• Privileged account separation
• Lead AD hardening activities:
• LAPS
• Protected Users
• Delegation and admin access restrictions
• Troubleshoot complex AD security and authentication issues

Hybrid Identity & Integration

• Support Entra Connect configuration and lifecycle management
• Assist in evaluating authentication models and hybrid trust decisions
• Support integration of identity with:
• Azure subscriptions
• Third‑party SaaS applications

Threat Detection & Operations

• Support CyberDefence team for Identity (MDI) investigations and tuning
• Act as a technical escalation point during identity‑related incidents

Collaboration & Mentoring

• Mentor mid‑level engineers and provide technical guidance
• Participate in design reviews and provide implementation feedback
• Work closely with Identity Architects, Security, and Platform teams
• 8–10 years of experience in identity and access management
• Strong hands‑on experience with:
• Microsoft Entra ID P2
• Conditional Access at scale
• Privileged Identity Management
• Active Directory security
• Experience supporting hybrid AD environments
• Advanced PowerShell scripting and automation
• Strong understanding of identity‑based attack techniques and mitigations
• Solid grasp of Zero Trust principles (implementation‑focused)
• Experience with:
• Concepts around IGA
• Defender for Identity
• Passwordless authentication (FIDO2, WHfB)
• VDI or shared device environments
• Certifications:
• SC‑300
• AZ‑500
• Microsoft Security certifications