Identity Management Consultant

The Senior Identity & Access Management (IAM) Engineer is a hands-on implementation role responsible for building, configuring, and operating Azure Entra ID and Azure RBAC controls within an Azure tenant supporting Operational Technology (OT) environments in oil & gas refining. This role focuses on execution of IAM capabilities, including Conditional Access, Privileged Identity Management (PIM), RBAC, and identity lifecycle processes. The engineer will translate architectural direction and security requirements into working, enforceable configurations in Azure. The ideal candidate brings deep technical expertise in Azure IAM, strong Active Directory experience, and a practical understanding of how to implement Zero Trust principles within Azure to support segmented, safety-critical OT environments. Key Responsibilities Build and configure Azure Entra ID controls, including Conditional Access policies, MFA enforcement, Identity Protection configurations Implement and manage Azure RBAC role assignments and custom roles Configure and operate Privileged Identity Management (PIM) for just-in-time (JIT) access Deploy and manage managed identities, service principals, and workload identities Execute identity lifecycle processes (provisioning, deprovisioning, access changes) Implement Zero Trust principles within Azure, including strong authentication and device/user context via Conditional Access, least privilege access using RBAC and PIM, elimination of standing privilege Enforce policy-based access decisions rather than network-based trust Continuously validate and tighten access paths to reduce identity-based attack surface Identity Configuration for OT Environments Implement IAM controls that enforce strict segmentation aligned to Purdue Model concepts Ensure access to OT resources is controlled through Azure identity and policy enforcement Validate that configurations prevent lateral movement between OT zones and privilege escalation across roles or environments Active Directory & Hybrid Identity Integrate and support Active Directory (AD DS) in hybrid identity scenarios where required Configure and maintain Entra Connect or federation components as applicable Ensure secure boundaries between on-prem AD and Azure tenant IAM controls Security Monitoring & Operational Support Configure and support logging for sign-in activity, PIM role activations, role and policy changes Integrate identity data into SIEM platforms (e.g., Microsoft Sentinel) Develop KQL queries and alerts for operational monitoring and threat detection Support troubleshooting of authentication, authorization, and access issues Governance Execution Implement and maintain RBAC models, access policies, identity standards defined by architecture and security teams Ensure identities have ownership, defined purpose, appropriate access scope and review processes Work closely with architecture, OT, security, and cloud teams to implement defined IAM designs Provide feedback on design feasibility and operational impact based on implementation experience Support audits, control validation, and compliance activities Required Experience & Skills Expert-level hands-on experience implementing Azure Entra ID, including Conditional Access, MFA, PIM, Identity Protection Deep, practical experience with Azure RBAC configuration and troubleshooting Strong experience implementing managed identities and service principals, workload identity access controls Active Directory Strong experience with Active Directory (AD DS): domain administration and structure, Group Policy, hybrid identity integration (Entra Connect, federation) Zero Trust (Practical Application) Experience implementing Zero Trust concepts in Azure, including identity-based access enforcement, Conditional Access policy design, just-in-time and least-privilege access models Ability to translate Zero Trust principles into real Azure configurations Security & IAM Practices Strong experience with least privilege access enforcement, role-based access design and implementation, privileged access controls and monitoring Ability to troubleshoot complex identity and access issues in production environments Security Frameworks & Industry Standards (Oil & Gas Focus) Working knowledge and practical alignment with: NIST CSF (critical infrastructure) NIST SP View phone number on click.appcast.io (identity controls)

ISO/IEC 27001

Zero Trust (NIST 800-207) applied in Azure environments Experience supporting IAM in oil & gas refining or industrial environments Understanding of Purdue Model segmentation, IEC 62443 zones and conduits Ability to implement IAM controls that align with operational safety and reliability requirements Required Experience 10+ years in IAM, identity engineering, or security engineering; 5+ years of hands-on Azure IAM / Entra ID implementation; 5+ years working with Active Directory (AD DS); Experience in large-scale enterprise or OT environments, preferably oil & gas Preferred Certifications Microsoft SC-300 Microsoft SC-100 Microsoft AZ-500 CISSP or GIAC (e.g., GICSP) Senior – Hands-on Engineering (Implementation-Focused) Primary Focus Implementation and operation of Azure Entra ID and Azure RBAC IAM controls to support a secure, segmented, Zero Trust–aligned OT Azure environment in oil & gas refining Disclaimer HCL is an equal opportunity employer, committed to providing equal employment opportunities to all applicants and employees regardless of race, religion, sex, color, age, national origin, pregnancy, sexual orientation, physical disability or genetic information, military or veteran status, or any other protected classification, in accordance with federal, state, and/or local law. Should any applicant have concerns about discrimination in the hiring process, they should provide a detailed report of those concerns to View email address on click.appcast.io for investigation. Compensation and Benefits A candidate’s pay within the range will depend on their work location, skills, experience, education, and other factors permitted by law. This role may also be eligible for performance-based bonuses subject to company policies. In addition, this role is eligible for the following benefits subject to company policies: medical, dental, vision, pharmacy, life, accidental death & dismemberment, and disability insurance; employee assistance program; 401(k) retirement plan; 10 days of paid time off per year (some positions are eligible for need-based leave with no designated number of leave days per year); and 10 paid holidays per year. #J-18808-Ljbffr HCLTech