Senior IAM Engineer - (Entra ID/AD)
for section headings (e.g., About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). Use - for any list of duties/requirements/benefits, and
for prose. Do NOT repeat the job title as a heading (the page already shows it) and do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short
or drop it. Preserve ALL substantive information; do NOT invent or summarize away detail. Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. IMPORTANT: include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text (e.g., "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless the posting actually states them. Prefer a few substantive sections over many thin ones. Output ONLY the HTML fragment — no /, no markdown code fences.
We need to decide which sections to include based on content.
The posting includes:
- Intro about CLA (company description). Could be "About the role"? Actually "About the role" is typical heading for description of role and company. We can put that as a section.
- Responsibilities: many bullet points under "How you’ll create opportunities in this Identity & Access Management (IAM) Senior Engineer position" and then sub-sections: Identity Governance & Access Management, Identity Architecture & Platform Administration, Infrastructure Automation & Engineering. Those are responsibilities.
- Technical Competencies: list of required skills/experience.
- Experience: "As our ideal candidate, you have: 4+ years of experience required..." plus bullet list.
- Preferred Qualifications: bullet list.
- Education: Bachelor's degree required, etc.
- Benefits: "Wellness at CLA ... offer comprehensive benefit options that include health, dental, vision, 401k and much more. To view a complete list of benefits, click here." This is vague but mentions specific benefits: health, dental, vision, 401k. It says "comprehensive benefit options". It's not placeholder; it's specific enough? It mentions health, dental, vision, 401k. So we can include a Benefits section with those items.
- Pay: Not mentioned. So we should NOT include Pay section.
- Schedule: Not mentioned. So no Schedule.
We need to avoid duplication. Also need to remove boilerplate like "Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities Click here to learn about your hiring rights." and "Wellness at CLA ..." we already used for benefits but need to strip the "Click here to view a complete list of benefits" maybe keep as prose? The instruction: Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The "Wellness at CLA" is not boilerplate; it's describing benefits. We can keep that as prose, but we need to format benefits as list.
We need to preserve ALL substantive information; do not invent or summarize away detail. So we need to keep all bullet points exactly as they appear (maybe rephrase? but must preserve meaning). We can keep them as list items.
We need to avoid creating sections with filler. So we will have sections: About the role (company description + role overview), Responsibilities (maybe split into sub-sections? But we can just have one Responsibilities section with all duty bullets). Could also have subheadings but only h3 allowed for section headings; we could still use h3 for sub-sections? The instruction: use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It suggests those are typical section headings; but we could also use h3 for sub-sections if we want, but better to stick to those main sections. However we have a lot of responsibilities broken into categories; we could keep them as a single list.
We also have Technical Competencies, Experience, Preferred Qualifications, Education. Those could map to Requirements, Qualifications, Skills sections. The instruction says use those headings as examples; we can decide which to use.
We have:
- Technical Competencies: list of skills/experience (hands-on experience). This could be Skills.
- Experience: "As our ideal candidate, you have: 4+ years of experience required..." plus bullet list. This could be Requirements.
- Preferred Qualifications: bullet list. Could be Qualifications.
- Education: Bachelor's degree required... Could be Qualifications or Requirements.
We need to avoid duplication. Perhaps combine Requirements (experience + education) and Qualifications (preferred qualifications). Skills separate.
Let's outline:
About the role
CLA is a top 10 national professional services firm where our purpose is to create opportunities every day, for our clients, our people, and our communities through industry-focused wealth advisory, digital, audit, tax, consulting, and outsourcing services. Even with more than 8,500 people, 130 U.S. locations, and a global reach, we promise to know you and help you. CLA is dedicated to building a culture that invites different beliefs and perspectives to the table, so we can truly know and help our clients, communities, and each other. CLA is growing and seeking to hire an experienced Identity & Access Management (IAM) Senior Engineer to join our talented Information Technology team. The position offers growth, flexibility and a collaborative work environment.
That covers the intro.
Now Responsibilities: we need to list all duties from the "How you’ll create opportunities..." and the sub-sections.
Let's extract bullet points:
From after "How you’ll create opportunities in this Identity & Access Management (IAM) Senior Engineer position":
- Execute the implementation and maintenance of complex Identity & Access Management (IAM) infrastructure.
- Plan and execute IAM projects and programs, ensuring alignment with business requirements, security standards, and delivery timelines.
- Automate and optimize identity lifecycle management processes, access provisioning, and governance controls.
- Integrate Entra ID with enterprise systems, cloud platforms, and third-party applications.
- Collaborate with cross-functional teams to support and drive IAM program goals and enterprise security initiatives.
- Monitor, troubleshoot, and maintain IAM infrastructure, ensuring optimal performance, reliability, and security.
- Document and maintain comprehensive IAM architecture, workflows, standards, and operating procedures.
- Implement and enforce IAM security, compliance, governance, and risk management best practices.
- Provide technical leadership and mentorship to junior team members.
- Participate in an on-call rotation supporting critical IAM systems and services.
Then sub-section "Identity Governance & Access Management":
- Design and support Role-Based Access Control (RBAC) models and access governance frameworks.
- Manage Privileged Identity Management (PIM) processes and privileged access controls.
- Implement and support passwordless authentication, managed identities, and modern identity security practices.
- Develop and maintain identity lifecycle processes, including onboarding, transfers, and offboarding.
- Ensure access controls comply with regulatory, audit, and security requirements.
- Support Identity Governance and Administration (IGA) capabilities and access certification processes.
Then "Identity Architecture & Platform Administration":
- Administer and support Microsoft Entra ID, Active Directory, and hybrid identity environments.
- Manage on-premises Active Directory infrastructure, including Domain Controllers, organizational units, and directory services.
- Design, maintain, and enforce Group Policy Objects (GPOs) to support enterprise security and operational requirements.
- Design, implement, and maintain identity federation and authentication solutions.
- Support SAML, OAuth, and OpenID Connect integrations across enterprise applications.
- Implement and maintain Entra B2B, Entra External Identity, and Conditional Access Policies.
- Partner with business and technical teams to evaluate identity and access requirements for new systems and applications.
- Develop scalable and secure identity solutions that support cloud and hybrid environments.
Then "Infrastructure Automation & Engineering":
- Develop and maintain Infrastructure as Code (IaC) solutions utilizing Terraform and related automation frameworks.
- Create and support automation solutions using PowerShell, Python, and Bash scripting.
- Improve operational efficiency through automation and process standardization.
- Support Active Directory, Group Policy, DNS, Entra ID, and Azure identity services across the enterprise.
- Continuously evaluate and implement improvements to IAM infrastructure and operational processes.
All these are responsibilities.
Now Technical Competencies (Skills):
- Strong hands-on experience administering Active Directory, Domain Controllers, Group Policy Objects (GPO), and DNS services.
- Strong hands-on experience with Microsoft Entra ID administration and identity lifecycle management.
- Advanced PowerShell scripting and automation experience.
- Experience designing and managing Conditional Access Policies.
- Experience with Identity Governance and Administration (IGA) platforms and controls.
- Knowledge of SAML, OAuth, OpenID Connect, and modern authentication protocols.
- Experience with RBAC, PIM, passwordless authentication, managed identities, and identity governance technologies.
- Experience with Terraform, Infrastructure as Code (IaC), and automation frameworks.
- Experience supporting cloud, hybrid, and enterprise IAM environments.
- Experience with PingOne is preferred.
Now Experience (Requirements):
- As our ideal candidate, you have: 4+ years of experience required
- Experience managing hybrid identity environments across Microsoft Entra ID and Active Directory.
- Experience administering Domain Controllers, Group Policy, DNS, and enterprise authentication services.
- Experience implementing Conditional Access, RBAC, PIM, and identity governance solutions.
- Experience developing PowerShell automations and Infrastructure as Code solutions.
- Experience integrating enterprise applications using SAML, OAuth, and OpenID Connect.
Now Preferred Qualifications:
- Experience with PingOne and other enterprise identity platforms.
- Experience with Entra B2B and Entra External Identity.
- Experience supporting identity governance, access certification, and compliance programs.
- Relevant Microsoft, Security, Identity, or Cloud certifications preferred.
Now Education:
- Bachelor's degree is required.
- Combination of relevant experience, education, and training may be accepted in lieu of degree.
- Degrees in Computer Science, Information Technology, or a related field are preferred.
Now Benefits:
- Wellness at CLA To support our CLA family members, we focus on their physical, financial, social, and emotional well-being and offer comprehensive benefit options that include health, dental, vision, 401k and much more. To view a complete list of benefits, click here.
We need to turn that into a list: health, dental, vision, 401k. Also mention wellness focus? Could keep prose then list.
We should not include "Click here to view a complete list of benefits" as it's an instruction/link; maybe drop as it's application instruction? It's not exactly application instruction but it's a link. The instruction says remove application instructions. This is a link to view benefits; could be considered navigation. Safer to drop that sentence. Keep the substantive benefit info: health, dental, vision, 401k. Also mention wellness focus? That's substantive: "we focus on their physical, financial, social, and emotional well-being". Could keep as prose.
Thus Benefits section: We focus on physical, financial, social, and emotional well-being and offer comprehensive benefit options that include health, dental, vision, 401k.
plus maybe a list.
We could do - Health
- Dental
- Vision
- 401k
.
Now we need to ensure we don't repeat job title as heading. We didn't.
Now we need to output only HTML fragment.
Let's construct:
About the role
CLA is a top 10 national professional services firm where our purpose is to create opportunities every day, for our clients, our people, and our communities through industry-focused wealth advisory, digital
for prose. Do NOT repeat the job title as a heading (the page already shows it) and do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short
or drop it. Preserve ALL substantive information; do NOT invent or summarize away detail. Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. IMPORTANT: include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text (e.g., "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless the posting actually states them. Prefer a few substantive sections over many thin ones. Output ONLY the HTML fragment — no /, no markdown code fences. We need to decide which sections to include based on content. The posting includes: - Intro about CLA (company description). Could be "About the role"? Actually "About the role" is typical heading for description of role and company. We can put that as a section. - Responsibilities: many bullet points under "How you’ll create opportunities in this Identity & Access Management (IAM) Senior Engineer position" and then sub-sections: Identity Governance & Access Management, Identity Architecture & Platform Administration, Infrastructure Automation & Engineering. Those are responsibilities. - Technical Competencies: list of required skills/experience. - Experience: "As our ideal candidate, you have: 4+ years of experience required..." plus bullet list. - Preferred Qualifications: bullet list. - Education: Bachelor's degree required, etc. - Benefits: "Wellness at CLA ... offer comprehensive benefit options that include health, dental, vision, 401k and much more. To view a complete list of benefits, click here." This is vague but mentions specific benefits: health, dental, vision, 401k. It says "comprehensive benefit options". It's not placeholder; it's specific enough? It mentions health, dental, vision, 401k. So we can include a Benefits section with those items. - Pay: Not mentioned. So we should NOT include Pay section. - Schedule: Not mentioned. So no Schedule. We need to avoid duplication. Also need to remove boilerplate like "Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities Click here to learn about your hiring rights." and "Wellness at CLA ..." we already used for benefits but need to strip the "Click here to view a complete list of benefits" maybe keep as prose? The instruction: Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The "Wellness at CLA" is not boilerplate; it's describing benefits. We can keep that as prose, but we need to format benefits as list. We need to preserve ALL substantive information; do not invent or summarize away detail. So we need to keep all bullet points exactly as they appear (maybe rephrase? but must preserve meaning). We can keep them as list items. We need to avoid creating sections with filler. So we will have sections: About the role (company description + role overview), Responsibilities (maybe split into sub-sections? But we can just have one Responsibilities section with all duty bullets). Could also have subheadings but only h3 allowed for section headings; we could still use h3 for sub-sections? The instruction: use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It suggests those are typical section headings; but we could also use h3 for sub-sections if we want, but better to stick to those main sections. However we have a lot of responsibilities broken into categories; we could keep them as a single list.
We also have Technical Competencies, Experience, Preferred Qualifications, Education. Those could map to Requirements, Qualifications, Skills sections. The instruction says use those headings as examples; we can decide which to use.
We have:
- Technical Competencies: list of skills/experience (hands-on experience). This could be Skills.
- Experience: "As our ideal candidate, you have: 4+ years of experience required..." plus bullet list. This could be Requirements.
- Preferred Qualifications: bullet list. Could be Qualifications.
- Education: Bachelor's degree required... Could be Qualifications or Requirements.
We need to avoid duplication. Perhaps combine Requirements (experience + education) and Qualifications (preferred qualifications). Skills separate.
Let's outline:
About the role
CLA is a top 10 national professional services firm where our purpose is to create opportunities every day, for our clients, our people, and our communities through industry-focused wealth advisory, digital, audit, tax, consulting, and outsourcing services. Even with more than 8,500 people, 130 U.S. locations, and a global reach, we promise to know you and help you. CLA is dedicated to building a culture that invites different beliefs and perspectives to the table, so we can truly know and help our clients, communities, and each other. CLA is growing and seeking to hire an experienced Identity & Access Management (IAM) Senior Engineer to join our talented Information Technology team. The position offers growth, flexibility and a collaborative work environment.
That covers the intro. Now Responsibilities: we need to list all duties from the "How you’ll create opportunities..." and the sub-sections. Let's extract bullet points: From after "How you’ll create opportunities in this Identity & Access Management (IAM) Senior Engineer position": - Execute the implementation and maintenance of complex Identity & Access Management (IAM) infrastructure. - Plan and execute IAM projects and programs, ensuring alignment with business requirements, security standards, and delivery timelines. - Automate and optimize identity lifecycle management processes, access provisioning, and governance controls. - Integrate Entra ID with enterprise systems, cloud platforms, and third-party applications. - Collaborate with cross-functional teams to support and drive IAM program goals and enterprise security initiatives. - Monitor, troubleshoot, and maintain IAM infrastructure, ensuring optimal performance, reliability, and security. - Document and maintain comprehensive IAM architecture, workflows, standards, and operating procedures. - Implement and enforce IAM security, compliance, governance, and risk management best practices. - Provide technical leadership and mentorship to junior team members. - Participate in an on-call rotation supporting critical IAM systems and services. Then sub-section "Identity Governance & Access Management": - Design and support Role-Based Access Control (RBAC) models and access governance frameworks. - Manage Privileged Identity Management (PIM) processes and privileged access controls. - Implement and support passwordless authentication, managed identities, and modern identity security practices. - Develop and maintain identity lifecycle processes, including onboarding, transfers, and offboarding. - Ensure access controls comply with regulatory, audit, and security requirements. - Support Identity Governance and Administration (IGA) capabilities and access certification processes. Then "Identity Architecture & Platform Administration": - Administer and support Microsoft Entra ID, Active Directory, and hybrid identity environments. - Manage on-premises Active Directory infrastructure, including Domain Controllers, organizational units, and directory services. - Design, maintain, and enforce Group Policy Objects (GPOs) to support enterprise security and operational requirements. - Design, implement, and maintain identity federation and authentication solutions. - Support SAML, OAuth, and OpenID Connect integrations across enterprise applications. - Implement and maintain Entra B2B, Entra External Identity, and Conditional Access Policies. - Partner with business and technical teams to evaluate identity and access requirements for new systems and applications. - Develop scalable and secure identity solutions that support cloud and hybrid environments. Then "Infrastructure Automation & Engineering": - Develop and maintain Infrastructure as Code (IaC) solutions utilizing Terraform and related automation frameworks. - Create and support automation solutions using PowerShell, Python, and Bash scripting. - Improve operational efficiency through automation and process standardization. - Support Active Directory, Group Policy, DNS, Entra ID, and Azure identity services across the enterprise. - Continuously evaluate and implement improvements to IAM infrastructure and operational processes. All these are responsibilities. Now Technical Competencies (Skills): - Strong hands-on experience administering Active Directory, Domain Controllers, Group Policy Objects (GPO), and DNS services. - Strong hands-on experience with Microsoft Entra ID administration and identity lifecycle management. - Advanced PowerShell scripting and automation experience. - Experience designing and managing Conditional Access Policies. - Experience with Identity Governance and Administration (IGA) platforms and controls. - Knowledge of SAML, OAuth, OpenID Connect, and modern authentication protocols. - Experience with RBAC, PIM, passwordless authentication, managed identities, and identity governance technologies. - Experience with Terraform, Infrastructure as Code (IaC), and automation frameworks. - Experience supporting cloud, hybrid, and enterprise IAM environments. - Experience with PingOne is preferred. Now Experience (Requirements): - As our ideal candidate, you have: 4+ years of experience required - Experience managing hybrid identity environments across Microsoft Entra ID and Active Directory. - Experience administering Domain Controllers, Group Policy, DNS, and enterprise authentication services. - Experience implementing Conditional Access, RBAC, PIM, and identity governance solutions. - Experience developing PowerShell automations and Infrastructure as Code solutions. - Experience integrating enterprise applications using SAML, OAuth, and OpenID Connect. Now Preferred Qualifications: - Experience with PingOne and other enterprise identity platforms. - Experience with Entra B2B and Entra External Identity. - Experience supporting identity governance, access certification, and compliance programs. - Relevant Microsoft, Security, Identity, or Cloud certifications preferred. Now Education: - Bachelor's degree is required. - Combination of relevant experience, education, and training may be accepted in lieu of degree. - Degrees in Computer Science, Information Technology, or a related field are preferred. Now Benefits: - Wellness at CLA To support our CLA family members, we focus on their physical, financial, social, and emotional well-being and offer comprehensive benefit options that include health, dental, vision, 401k and much more. To view a complete list of benefits, click here. We need to turn that into a list: health, dental, vision, 401k. Also mention wellness focus? Could keep prose then list. We should not include "Click here to view a complete list of benefits" as it's an instruction/link; maybe drop as it's application instruction? It's not exactly application instruction but it's a link. The instruction says remove application instructions. This is a link to view benefits; could be considered navigation. Safer to drop that sentence. Keep the substantive benefit info: health, dental, vision, 401k. Also mention wellness focus? That's substantive: "we focus on their physical, financial, social, and emotional well-being". Could keep as prose. Thus Benefits section:We focus on physical, financial, social, and emotional well-being and offer comprehensive benefit options that include health, dental, vision, 401k.
plus maybe a list. We could do- Health
- Dental
- Vision
- 401k
About the role
CLA is a top 10 national professional services firm where our purpose is to create opportunities every day, for our clients, our people, and our communities through industry-focused wealth advisory, digital