Senior IAM Engineer - (Entra ID/AD)
CLA (CliftonLarsonAllen) · Hudson, WI · 1 mo ago
Art & CreativeFull-time
We need to output HTML fragment with sections: About the role? Actually the posting includes description about CLA, purpose, etc. We need to use headings for sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections when there is real specific content. We must not repeat job title as heading. No Job ID. Remove boilerplate: EEO, legal, navigation, cookie, application instructions, etc. Also remove "Wellness at CLA" maybe part of Benefits? It mentions benefits: health, dental, vision, 401k and much more. That's benefits content. So we can have Benefits section with that info.
We need to preserve all substantive information. Let's parse.
Content:
- Intro about CLA: "CLA is a top 10 national professional services firm where our purpose is to create opportunities every day, for our clients, our people, and our communities through industry-focused wealth advisory, digital, audit, tax, consulting, and outsourcing services. Even with more than 8,500 people, 130 U.S. locations, and a global reach, we promise to know you and help you. CLA is dedicated to building a culture that invites different beliefs and perspectives to the table, so we can truly know and help our clients, communities, and each other. CLA is growing and seeking to hire an experienced Identity & Access Management (IAM) Senior Engineer to join our talented Information Technology team. The position offers growth, flexibility and a collaborative work environment."
That's about the role/company. Could be "About the role" or "About CLA". Use heading About the role.
- Then "How you’ll create opportunities in this Identity & Access Management (IAM) Senior Engineer position" followed by bullet list of responsibilities (actually it's a list of duties). Those are responsibilities.
List:
Execute the implementation and maintenance of complex Identity & Access Management (IAM) infrastructure.
Plan and execute IAM projects and programs, ensuring alignment with business requirements, security standards, and delivery timelines.
Automate and optimize identity lifecycle management processes, access provisioning, and governance controls.
Integrate Entra ID with enterprise systems, cloud platforms, and third-party applications.
Collaborate with cross-functional teams to support and drive IAM program goals and enterprise security initiatives.
Monitor, troubleshoot, and maintain IAM infrastructure, ensuring optimal performance, reliability, and security.
Document and maintain comprehensive IAM architecture, workflows, standards, and operating procedures.
Implement and enforce IAM security, compliance, governance, and risk management best practices.
Provide technical leadership and mentorship to junior team members.
Participate in an on-call rotation supporting critical IAM systems and services.
Then there are sub-sections: "Identity Governance & Access Management", "Identity Architecture & Platform Administration", "Infrastructure Automation & Engineering". Those seem like more detailed responsibilities grouped. Could be part of responsibilities as well. We'll include them under Responsibilities as sub-items maybe as separate
- but still under same heading.
Then "Technical Competencies" list: Strong hands-on experience administering Active Directory, Domain Controllers, Group Policy Objects (GPO), and DNS services.
Strong hands-on experience with Microsoft Entra ID administration and identity lifecycle management.
Advanced PowerShell scripting and automation experience.
Experience designing and managing Conditional Access Policies.
Experience with Identity Governance and Administration (IGA) platforms and controls.
Knowledge of SAML, OAuth, OpenID Connect, and modern authentication protocols.
Experience with RBAC, PIM, passwordless authentication, managed identities, and identity governance technologies.
Experience with Terraform, Infrastructure as Code (IaC), and automation frameworks.
Experience supporting cloud, hybrid, and enterprise IAM environments.
Experience with PingOne is preferred.
That's skills/requirements.
Then "Experience As our ideal candidate, you have:" list:
4+ years of experience required
Experience managing hybrid identity environments across Microsoft Entra ID and Active Directory.
Experience administering Domain Controllers, Group Policy, DNS, and enterprise authentication services.
Experience implementing Conditional Access, RBAC, PIM, and identity governance solutions.
Experience developing PowerShell automations and Infrastructure as Code solutions.
Experience integrating enterprise applications using SAML, OAuth, and OpenID Connect.
That's requirements/experience.
Then "Preferred Qualifications" list:
Experience with PingOne and other enterprise identity platforms.
Experience with Entra B2B and Entra External Identity.
Experience supporting identity governance, access certification, and compliance programs.
Relevant Microsoft, Security, Identity, or Cloud certifications preferred.
That's qualifications/preferred.
Then "Education Bachelor's degree is required. Combination of relevant experience, education, and training may be accepted in lieu of degree.Degrees in Computer Science, Information Technology, or a related field are preferred."
That's qualifications/education.
Then "Wellness at CLA To support our CLA family members, we focus on their physical, financial, social, and emotional well-being and offer comprehensive benefit options that include health, dental, vision, 401k and much more. To view a complete list of benefits, click here."
That's benefits.
No explicit Pay or Schedule mentioned, so we omit those sections.
We must not include boilerplate: Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities Click here to learn about your hiring rights. Also "Wellness at CLA" we kept as benefits but we need to remove the "Click here to view a complete list of benefits" maybe it's application instruction? It's a link; we can keep the description but maybe drop the instruction. The instruction "To view a complete list of benefits, click here." is likely application instruction? It's not exactly applying but it's a link. According to rules: remove application instructions. So we should drop that sentence. Keep the benefit description.
Also remove "Wellness at CLA" heading? We can keep benefits section without heading "Wellness at CLA". Use heading Benefits.
Now structure:
- Execute the implementation and maintenance of complex Identity & Access Management (IAM) infrastructure.
- Plan and execute IAM projects and programs, ensuring alignment with business requirements, security standards, and delivery timelines.
- Automate and optimize identity lifecycle management processes, access provisioning, and governance controls.
- Integrate Entra ID with enterprise systems, cloud platforms, and third-party applications.
- Collaborate with cross-functional teams to support and drive IAM program goals and enterprise security initiatives.
- Monitor, troubleshoot, and maintain IAM infrastructure, ensuring optimal performance, reliability, and security.
- Document and maintain comprehensive IAM architecture, workflows, standards, and operating procedures.
- Implement and enforce IAM security, compliance, governance, and risk management best practices.
- Provide technical leadership and mentorship to junior team members.
- Participate in an on-call rotation supporting critical IAM systems and services.
- Identity Governance & Access Management: Design and support Role-Based Access Control (RBAC) models and access governance frameworks; Manage Privileged Identity Management (PIM) processes and privileged access controls; Implement and support passwordless authentication, managed identities, and modern identity security practices; Develop and maintain identity lifecycle processes, including onboarding, transfers, and offboarding; Ensure access controls comply with regulatory, audit, and security requirements; Support Identity Governance and Administration (IGA) capabilities and access certification processes.
- Identity Architecture & Platform Administration: Administer and support Microsoft Entra ID, Active Directory, and hybrid identity environments; Manage on-premises Active Directory infrastructure, including Domain Controllers, organizational units, and directory services; Design, maintain, and enforce Group Policy Objects (GPOs) to support enterprise security and operational requirements; Design, implement, and maintain identity federation and authentication solutions; Support SAML, OAuth, and OpenID Connect integrations across enterprise applications; Implement and maintain Entra B2B, Entra External Identity, and Conditional Access Policies; Partner with business and technical teams to evaluate identity and access requirements for new systems and applications; Develop scalable and secure identity solutions that support cloud and hybrid environments.
- Infrastructure Automation & Engineering: Develop and maintain Infrastructure as Code (IaC) solutions utilizing Terraform and related automation frameworks; Create and support automation solutions using PowerShell, Python, and Bash scripting; Improve operational efficiency through automation and process standardization; Support Active Directory, Group Policy, DNS, Entra ID, and Azure identity services across the enterprise; Continuously evaluate and implement improvements to IAM infrastructure and operational processes.
- Strong hands-on experience administering Active Directory, Domain Controllers, Group Policy Objects (GPO), and DNS services.
- Strong hands-on experience with Microsoft Entra ID administration and identity lifecycle management.
- Advanced PowerShell scripting and automation experience.
- Experience designing and managing Conditional Access Policies.
- Experience with Identity Governance and Administration (IGA) platforms and controls.
- Knowledge of SAML, OAuth, OpenID Connect, and modern authentication protocols.
- Experience with RBAC, PIM, passwordless authentication, managed identities, and identity governance technologies.
- Experience with Terraform, Infrastructure as Code (IaC), and automation frameworks.
- Experience supporting cloud, hybrid, and enterprise IAM environments.
- Experience with PingOne is preferred.
- 4+ years of experience required
- Experience managing hybrid identity environments across Microsoft Entra ID and Active Directory.
- Experience administering Domain Controllers, Group Policy, DNS, and enterprise authentication services.
- Experience implementing Conditional Access, RBAC, PIM, and identity governance solutions.
- Experience developing PowerShell automations and Infrastructure as Code solutions.
- Experience integrating enterprise applications using SAML, OAuth, and OpenID Connect.
- Experience with PingOne and other enterprise identity platforms.
- Experience with Entra B2B and Entra External Identity.
- Experience supporting identity governance, access certification, and compliance programs.
- Relevant Microsoft, Security, Identity, or Cloud certifications preferred.
- Bachelor's degree is required. Combination of relevant experience, education, and training may be accepted in lieu of degree.
- Degrees in Computer Science, Information Technology, or a related field are preferred.
About the role
CLA is a top 10 national professional services firm where our purpose is to create opportunities every day, for our clients, our people, and our communities through industry-focused wealth advisory, digital, audit, tax, consulting, and outsourcing services. Even with more than 8,500 people, 130 U.S. locations, and a global reach, we promise to know you and help you. CLA is dedicated to building a culture that invites different beliefs and perspectives to the table, so we can truly know and help our clients, communities, and each other. CLA is growing and seeking to hire an experienced Identity & Access Management (IAM) Senior Engineer to join our talented Information Technology team. The position offers growth, flexibility and a collaborative work environment.
Responsibilities
Skills
Requirements
Qualifications
Benefits
To support our CLA family members, we focus on their physical, financial, social, and emotional well-being and offer comprehensive benefit options that include health, dental, vision, 401k and much more.
We removed the click here instruction. Check for any leftover boilerplate: We removed EEO line. Also removed "Click here to learn