Entra ID Engineer Consultant Access Management & Identity Governance

ABOUT KALLES GROUP:

Everyone deserves to be secure. Our mission at Kalles Group is to help secure the future for companies of all shapes and sizes.

While our expertise spans multiple disciplines our method remains consistent: building trust and relationship with people -- whether you are a client a consultant or--in this case--a candidate.

No matter what role you come from--whether youre an executive or just starting your career-you can expect our highest level of attention and respect. We want to find the right fit for each role but we also want you to find the right fit for your career.

We believe the best way to show you what our team is like is to treat you like youre already a part of it . We hope youll consider joining our team of experienced professionals who are building their careers at Kalles Groupand having fun while doing it.

WHAT YOU WILL DO:

As a Senior Microsoft Entra ID Engineer youll be on assignment with one of our enterprise clients helping lead a large workforce identity migration. Authentication for thousands of applications including many complex SAML integrations is moving from a legacy identity provider to Microsoft Entra ID. Youll own the design build and operation of access management and identity governance in Entra and youll have a lot of autonomy. Your work will include Conditional Access and authentication strategy (phishing-resistant MFA and passwordless) Privileged Identity Management application SSO and provisioning B2B access and the full Entra ID Governance suite: entitlement management access reviews and lifecycle workflows. Youll make Entra-native governance work cleanly alongside SailPoint Identity Security Cloud and hybrid Active Directory and youll automate with Microsoft Graph PowerShell and Infrastructure as Code. Youll also set engineering standards and mentor other engineers on the team.

KEY RESPONSIBILITIES:

ACCESS MANAGEMENT (Entra ID)

Design and maintain Conditional Access architecture persona/risk-based policies device & location conditions session controls Authentication Strengths for phishing-resistant MFA.

Own authentication methods strategy and rollout passwordless/FIDO2/passkeys Windows Hello for Business certificate-based auth; retire weaker methods.

Administer Privileged Identity Management (PIM) eligible assignments JIT activation approvals privileged role & PIM-for-groups reviews.

Manage application access enterprise app SSO (SAML/OIDC) app role assignments SCIM provisioning.

Design external identity / B2B controls cross-tenant access settings guest governance partner access patterns.

IDENTITY GOVERNANCE (Entra ID Governance)

Build and operate Entitlement Management access packages catalogs policies approval/expiration workflows separation-of-duties checks.

Design and run Access Reviews across groups apps privileged roles and guests including recurring/automated reviews with auto-remediation.

Implement Lifecycle Workflows HR-driven joiner/mover/leaver and scheduled governance tasks.

Configure HR-driven inbound provisioning and outbound SCIM app provisioning.

Integrate Entra-native governance with SailPoint ISC and hybrid AD defining ownership boundaries and avoiding duplicate controls.

ACROSS THE ROLE

Automation and config-as-code (PowerShell Microsoft Graph API / Graph PowerShell SDK Terraform/Bicep).

Produce reference designs standards and documentation; review other engineers designs/configs.

Partner with SecOps so identity telemetry supports threat detection.

Mentor engineers; act as Entra access/governance SME. Use AI tooling to accelerate design and documentation.

ABOUT YOU:

Your values:

• • Integrity: You believe in doing the right thing even when its uncomfortable seemingly inefficient or costly.
  • Purposefulness: You have a desire to serve others with your skillset and an openness to continuous learning and growth.
  • Ownership: You stick to your commitments follow up with action and seek clarity in communication & expectations.

YOUR EXPERIENCE:

Required Qualifications

Bachelors/masters in CS Cybersecurity IT or equivalent experience.

4 years in IAM or security engineering with a track record leading technical projects.

Deep hands-on Microsoft Entra ID: Conditional Access authentication methods PIM Entra ID Protection.

Hands-on Entra ID Governance: entitlement management (access packages) access reviews lifecycle workflows.

Expert knowledge of SAML OAuth 2.0 OIDC SCIM and their security implications.

Hybrid identity: Entra Connect / Cloud Sync with on-prem AD; governing access across both.

Automating Entra via Microsoft Graph API / Graph PowerShell SDK; PowerShell Python; Terraform or Bicep.

System-level design thinking; able to set standards others build against.

Clear communication with engineers and stakeholders; operates autonomously in a fast-paced environment.

Preferred Qualifications

Certifications: SC-300 SC-100 AZ-500 CISSP or SailPoint.

Entra governance alongside an enterprise IGA (SailPoint IdentityNow / ISC).

PAM familiarity (e.g. BeyondTrust) and how PAM and PIM complement each other.

External/B2B identity at scale cross-tenant collaboration guest governance.

ITDR exposure; feeding identity signals into SIEM/SOAR.

Entra Verified ID Permissions Management or Global Secure Access.

Large-scale retail ecommerce or high-transaction enterprise experience.

WHAT WE OFFER:

• The annual salary range for this role is $135000-$155000.
• We offer Medical Dental Vision plans 401K with matching and PTO for salaried employees.
• Work/life balance we know theres more to life than work! We encourage our team to pursue other passions get outside and spend time with family. We work with clients and consultants to set expectations for a manageable workload.

LOCATION:

This role is hybrid with onsite requirements at our clients location in Seattle WA. Therefore we are currently only considering candidates that are already living in the Seattle area.

HOW TO APPLY:

Please fill out the form below (including uploading your most recent resume) and well be in touch! We know imposter syndrome can be a barrier to many great applicants. We hope youll still consider applying. Thats why weve made the application process as short and simple as possible.

Even if youre not a fit for the role you can expect to hear back from us! We want you to have the best experience as a candidate so please feel free to share feedback at any stage of the process to .

Kalles Group is an equal-opportunity employer and does not discriminate on the basis of creed nationality race ethnicity disability gender or other protected class.

Required Experience:

Contract