Privileged Access & Identity Security Architect - Entra ID

Role summary

You will own how identity and privileged access are designed and governed across a hybrid Microsoft estate. As part of a zero-trust program, and building on lessons from recent identity incidents, you will define a tightened privileged access model in Entra ID and on-prem AD, set the policies and standards, and hold teams to them through reviews and governance. You are the policy owner and design authority; platform teams implement and operate under your direction.

Key responsibilities:

Privileged access architecture

• Design and own the privileged access model based on Microsoft's Enterprise Access Model (control, management and user/workload planes), covering Entra ID and on-prem AD.
• Define standards for Privileged Identity Management (PIM): just-in-time, time-bound elevation, approval workflows, justification, MFA on activation, and PIM for Groups.
• Minimize standing privilege: remove permanent Global Administrator and other high-impact role assignments, apply least-privilege and custom roles, and use administrative units and restricted management where suitable.
• Define emergency access (break-glass) accounts, privileged access workstation requirements and secure admin pathways.

Identity controls and zero trust

• Design the Conditional Access framework: baseline policies, admin-specific policies, device compliance, location and risk conditions, authentication strengths and session controls.
• Drive phishing-resistant authentication (FIDO2 keys, passkeys, Windows Hello for Business, certificate-based authentication) for all privileged users.
• Use Entra ID Protection user and sign-in risk signals, and define responses to risky identities.
• Govern hybrid identity: Entra Connect / Cloud Sync security, AD tiering, Tier 0 protection and hardening against common AD attacks.

Non-human and workload identities

• Set policy for service principals, managed identities, app registrations and enterprise apps: ownership, credential hygiene, secret and certificate rotation, and workload identity federation in place of secrets.
• Control application consent and high-privilege API permissions (for example, Microsoft Graph) to block consent phishing and over-privileged apps.
• Govern on-prem service accounts and group Managed Service Accounts.

Identity governance and review policies

• Design and run access reviews for privileged roles, groups, guest users and applications, with clear reviewers, cadence and auto-remediation.
• Define joiner-mover-leaver controls with Entra ID Governance (entitlement management, access packages, lifecycle workflows).
• Maintain identity security policies, standards and exceptions; align with ISO 27001, DPDP Act and healthcare/GxP audit requirements.
• Report identity risk and control health: standing privilege counts, PIM adoption, phishing-resistant MFA coverage, review completion and stale accounts.

Incident support

• Act as identity expert in incidents involving compromised accounts, token theft, privilege escalation or malicious consent, and lead the identity root cause and control fixes.

Must-have skills

• 10+ years in IAM/identity security, with deep Entra ID and Active Directory security expertise.
• Proven design and rollout of PIM, Conditional Access and access reviews at enterprise scale.
• Strong understanding of identity attacks (AiTM phishing, token replay, consent phishing, Kerberos attacks, DCSync) and the controls that stop them.
• Hybrid identity architecture: Entra Connect / Cloud Sync, AD tiering and Tier 0 protection.
• Experience writing identity policies and standards and winning adoption from IT and business teams.
• Strong documentation and stakeholder communication.

Good to have

• Entra ID Governance (entitlement management, lifecycle workflows) and Entra ID Protection in production.
• Identity threat detection tooling (for example, CrowdStrike Falcon Identity Protection or Microsoft Defender for Identity).
• Automation with Microsoft Graph and PowerShell for identity reporting.
• Experience in regulated industries, ideally healthcare or pharma.
• Certifications: SC-300, SC-100, AZ-500, CISSP, or equivalent.
• Looking for Immediate Joiners

What success looks like in 12 months

• No permanent Global Administrators outside break-glass accounts; all privileged roles eligible through PIM.
• 100% of privileged users on phishing-resistant authentication.
• Quarterly access reviews running for all privileged roles, with completion tracked.
• Workload identities inventoried, owned, and moved off long-lived secrets where possible.