Senior Identity Access Management Engineer (IT Services)

Job description

**About Charles River Associates** Charles River Associates is a leading global consulting firm that provides economic, financial, and business management expertise to major law firms, corporations and governments around the world. CRA advises clients on economic and financial matters pertaining to litigation and regulatory proceedings, and guides corporations through critical business strategy and performance-related issues. Since 1965, clients have engaged CRA for its combination of industry experience and rigorous, fact-based analysis that provide clients with clear, implementable solutions to complex business concerns. **Position Overview** The Information Technology (ITS) team at CRA is currently a Global team of 40 professionals dedicated to enhancing, maintaining, and developing the firm's technology infrastructure and security. The team is comprised of four functions: Service Delivery & Telecom, Enterprise Application Solutions, Infrastructure, Networking and Cloud Services and Security. Information Technology staff are based in the Boston, Chicago, London, Munich, New York, Oakland, and Washington, DC offices. Mainly a Microsoft house, CRA is looking to maximize the performance of our on-premise systems and hybrid infrastructure, meaning experience with cloud technologies is essential for this role. The Senior Identity Access Management Engineer is responsible for the design, implementation, and operational support of enterprise identity and access management solutions with a primary focus on the Microsoft Entra platform. This role serves as the subject matter expert (SME) for identity security, privileged access management, identity governance, and non-human identities (NHIs), ensuring secure and compliant access to enterprise resources across hybrid and cloud environments. This position plays a key role in advancing CRA's hybrid cloud strategy through Identity platform standardization, identity governance, and assist in automation-first operational workflows/practices. As an IAM Engineer you will help drive the adoption of Microsoft security best practices and modern identity architectures, leveraging Microsoft Entra ID, Entra ID Governance, Privileged Identity Management (PIM), Conditional Access, Identity Protection, and related Microsoft security services. Coordination across other teams within the IT department and across the firm, and some travel to other CRA offices will be expected. Some out-of-hours and weekend work will be required for scheduled upgrades and in response to unexpected outages. Typical responsibilities include: **Identity Platform Engineering** - Design, implement, and maintain enterprise identity solutions across Microsoft Entra ID, Active Directory, and hybrid identity environments - Architect secure authentication and authorization services leveraging Entra ID, Conditional Access, Identity Protection, MFA, and Privileged Identity Management (PIM) **Automation & Identity Lifecycle Management** - Develop and maintain automation solutions using PowerShell, Azure rest APIs, Graph, and JWT tokens - Automate identity provisioning, deprovisioning, access certification, credential rotation, and governance processes - Create integrations with enterprise systems to improve identity operations and reduce manual administration **Cloud Enablement, Operations & Support** - Provide operational support for Microsoft Entra and Active Directory services, ensuring availability, reliability, and security - Monitor, troubleshoot, and resolve complex identity, authentication, synchronization, and access-related issues - Collaborate with Cloud, Infrastructure, Security, and Application teams to onboard and secure enterprise applications; **Identity Security, Governance & Compliance** - Establish and maintain identity security standards, operational procedures, and access control policies - Support audit, compliance, and regulatory requirements through effective identity governance and privileged access controls - Identify and remediate identity-related risks in alignment with Zero Trust and Microsoft security best practices **Desired Qualifications** - Bachelor's degree (Master's desirable) in Computer Science, Information Systems or related discipline; - 8-10 years of prior hands-on professional experience with the most recent years as an IAM Engineer - Proven experience in designing, deploying, and managing an enterprise PAM environment with specialized knowledge related to Thycotic, CyberArk, or Microsoft privileged access solutions. - Automated identity lifecycle processes using PowerShell, Microsoft Graph API, Azure Automation, Logic Apps, or related automation platforms. - Implemented and supported Microsoft Entra ID, Entra ID Governance, Privileged Identity Management (PIM), and Conditional Access policies in enterprise-scale environments. - Hands-on experience with hybrid identity architectures, including Active Directory Domain Services (AD DS), Entra Connect, Cloud Sync, and federated authentication services. - Experience implementing and managing Single Sign-On (SSO) integrations using SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), and SCIM - Demonstrated ability in removing standing privilege by leveraging just-in-time access or other dynamic elevation models - Hands-on experience with cloud migrations while managing complex hybrid Active Directory environments - Knowledge of regulatory and security frameworks including NIST, CIS Controls, ISO 27001, and Zero Trust security standards. - Must be comfortable in customer-facing scenarios and effectively collaborating in cross-functional technical teams; - Self-motivated, with a strong ability to prioritize and execute tasks in a high-pressure environment; - Ability to travel to other offices and execute project plans with minimal oversight. **Additional Preferred Skills** - Experience with VMware Cloud Foundation (VCF), vSphere, and hybrid cloud architectures. - Microsoft Certified: Identity and Access Administrator Associate (SC-300) or Azure Solutions Architect Expert (AZ-305), or related Cloud Identity certifications. - Experience with Identity Threat Detection and Response (ITDR), identity security monitoring, and integrations with Microsoft Defender and Microsoft Sentinel. - Experience integrating AIOps, observability, or monitoring platforms. **To Apply** To be considered for the this position, we require: - **Resume** – please include current address, personal email and telephone number; - **Cover letter (optional)** – please describe your interest in CRA and how this role matches your goals. Also, please note if you have interest in a particular practice and/or a location preference. **Career Growth and Benefits** - CRA’s robust [skills development programs](https://www.crai.com/cra-careers/talent-development/), encompassing both formal and informal programs, encourage you to thrive as an individual and team member. Training includes technical training, presentation skills, internal seminars, and career mentoring and performance coaching from an assigned senior colleague. Additional leadership and collaboration opportunities exist through internal firm development activities. - We offer a comprehensive total rewards program including a superior benefits package, [wellness programming](https://www.crai.com/benefits/) to support physical, mental, emotional and financial well-being, and in-house [immigration support](https://www.crai.com/cra-careers/immigration-global-mobility/) for foreign nationals and international business travelers. **Work Location Flexibility** CRA creates a work environment that enables our colleagues to benefit from being together in the office to best deliver on our promise of career growth, mentorship and inclusivity. At the same time, we recognize that individuals realize a range of benefits when working from home periodically. We currently expect that individuals spend at least 3 to 4 days a week working in the office (which may include traveling to another CRA office or to client meetings), with specific days determined in coordination with your practice or team. **Responsible AI Use in Recruiting** We believe that recruiting is fundamentally a human process, and we are committed to a hiring process that is fair, transparent, and people-focused. While AI and other technology-enabled tools help our team operate more efficiently, we strive to provide every candidate with a personalized, thoughtful, and high-touch experience. As CRA invests significant human effort to find qualified members for our teams, we expect candidates to invest corresponding human effort to learn about CRA, prepare thoughtful application materials, and engage with our interviewers. Read more about appropriate hiring manager, recruiting team, and candidate AI at CRA [on our website](https://www.crai.com/cra-careers/ai-recruiting/). **Our Commitment to Equal Employment Opportunity** Charles River Associates is an equal opportunity employer (EOE). All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, disability, status as a protected veteran, or any other protected characteristic under applicable law. ***Salary and other compensation*** *A good-faith estimate of the annual base salary range for this position is $130,000-$152,500. Starting pay within this range may vary based on factors such as education level, experience, skills, geographic location, market conditions, and other qualifications of the successful candidate. This position is eligible for additional bonus incentive compensation. CRA offers a comprehensive benefits package, subject to eligibility requirements, which includes: medical, dental, and vision insurance; 401(k) retirement plan with employer match; life and disability insurance; paid time off (vacation, sick leave, holidays); paid parental leave; wellness programs and employee assistance resources; and commuter benefits.*