Senior Identity Access Management Engineer

About the role

Charles River Associates (CRA) is a leading global consulting firm providing economic, financial, and business management expertise to major law firms, corporations, and governments worldwide. Since 1965, CRA has delivered rigorous, fact-based analysis and clear, implementable solutions for complex business concerns. The Information Technology (ITS) team is a global group of 40 professionals across Boston, Chicago, London, Munich, New York, Oakland, and Washington, DC, organized into four functions: Service Delivery & Telecom, Enterprise Application Solutions, Infrastructure, Networking and Cloud Services, and Security. As a mainly Microsoft house, CRA is maximizing on-premise and hybrid infrastructure performance, making cloud technology experience essential.

The Senior Identity Access Management Engineer serves as the subject matter expert for identity security, privileged access management, identity governance, and non-human identities (NHIs), ensuring secure and compliant access across hybrid and cloud environments. This role drives Microsoft Entra platform standardization, identity governance, and automation-first operational workflows, with coordination across IT teams and some travel to other CRA offices. Occasional out-of-hours and weekend work is required for scheduled upgrades and unexpected outages.

Responsibilities

• Identity Platform Engineering
  • Design, implement, and maintain enterprise identity solutions across Microsoft Entra ID, Active Directory, and hybrid identity environments
  • Architect secure authentication and authorization services leveraging Entra ID, Conditional Access, Identity Protection, MFA, and Privileged Identity Management (PIM)
• Automation & Identity Lifecycle Management
  • Develop and maintain automation solutions using PowerShell, Azure REST APIs, Graph, and JWT tokens
  • Automate identity provisioning, deprovisioning, access certification, credential rotation, and governance processes
  • Create integrations with enterprise systems to improve identity operations and reduce manual administration
• Cloud Enablement, Operations & Support
  • Provide operational support for Microsoft Entra and Active Directory services, ensuring availability, reliability, and security
  • Monitor, troubleshoot, and resolve complex identity, authentication, synchronization, and access-related issues
  • Collaborate with Cloud, Infrastructure, Security, and Application teams to onboard and secure enterprise applications
• Identity Security, Governance & Compliance
  • Establish and maintain identity security standards, operational procedures, and access control policies
  • Support audit, compliance, and regulatory requirements through effective identity governance and privileged access controls
  • Identify and remediate identity-related risks in alignment with Zero Trust and Microsoft security best practices

Requirements

• Bachelor's degree (Master's desirable) in Computer Science, Information Systems, or related discipline
• 8–10 years of hands-on professional experience, with the most recent years as an IAM Engineer
• Proven experience designing, deploying, and managing an enterprise PAM environment with specialized knowledge of Thycotic, CyberArk, or Microsoft privileged access solutions
• Automated identity lifecycle processes using PowerShell, Microsoft Graph API, Azure Automation, Logic Apps, or related automation platforms
• Implemented and supported Microsoft Entra ID, Entra ID Governance, Privileged Identity Management (PIM), and Conditional Access policies in enterprise-scale environments
• Hands-on experience with hybrid identity architectures, including Active Directory Domain Services (AD DS), Entra Connect, Cloud Sync, and federated authentication services
• Experience implementing and managing Single Sign-On (SSO) integrations using SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), and SCIM
• Demonstrated ability in removing standing privilege by leveraging just-in-time access or other dynamic elevation models
• Hands-on experience with cloud migrations while managing complex hybrid Active Directory environments
• Knowledge of regulatory and security frameworks including NIST, CIS Controls, ISO 27001, and Zero Trust security standards
• Comfortable in customer-facing scenarios and effectively collaborating in cross-functional technical teams
• Self-motivated, with strong ability to prioritize and execute tasks in a high-pressure environment
• Ability to travel to other offices and execute project plans with minimal oversight

Preferred skills

• Experience with VMware Cloud Foundation (VCF), vSphere, and hybrid cloud architectures
• Microsoft Certified: Identity and Access Administrator Associate (SC-300) or Azure Solutions Architect Expert (AZ-305), or related Cloud Identity certifications
• Experience with Identity Threat Detection and Response (ITDR), identity security monitoring, and integrations with Microsoft Defender and Microsoft Sentinel
• Experience integrating AIOps, observability, or monitoring platforms

Benefits

• Comprehensive total rewards program including superior benefits package
• Wellness programming supporting physical, mental, emotional, and financial well-being
• In-house immigration support for foreign nationals and