Senior IAM Engineer (f/m/x)

The Senior IAM Engineer owns and operates Enpal’s workforce Identity & Access Management in Microsoft Entra ID. You ensure secure and scalable access through Conditional Access, a strong admin model, and reliable identity lifecycle (Joiner/Mover/Leaver) processes. You enable least-privilege access via RBAC, PIM/PAM, and recurring access reviews, while supporting secure collaboration and sharing. 

Policy Development and Governance: 

• Define and maintain IAM standards and guardrails for Entra ID (authentication, Conditional Access principles, privileged access, external collaboration). 

• Establish and maintain the admin model (role design, separation of duties, privileged role assignment approach) and enforce least privilege through RBAC. 

• Own processes for access reviews, exceptions, and evidence for audits related to identity controls. 

IAM Engineering and Operations: 

• Operate and continuously improve Microsoft Entra ID (tenant configuration, role design, groups, identity settings) as the central identity platform. 

• Design, implement, and maintain Conditional Access policies (including rollout strategy, exclusions, and safe operations). 

• Build and operate Joiner/Mover/Leaver lifecycle processes, ensuring timely provisioning and deprovisioning and reducing manual access handling. 

• Own Privileged Access controls: 

• Implement and operate PIM/PAM (activation workflows, approval, time-bound access, role eligibility). 

• Manage break-glass accounts and emergency access procedures (creation, secure storage, testing cadence). 

• Manage and govern identity objects and special cases: 

• Guest accounts and external collaboration controls 

• Shared mailboxes / mail-enabled objects / Distribution groups 

• Service/admin accounts 

• Microsoft 365 Groups / Security groups 

• Drive operational quality: documentation, runbooks, change planning, and troubleshooting of access/provisioning issues. 

Collaboration and Stakeholder Engagement: 

• Partner with Corp IT, HR, and app owners to ensure identity data quality and smooth onboarding/offboarding. 

• Advise teams on access design: RBAC models, group strategy, and reducing direct user entitlements. 

• Coordinate with Security and IT stakeholders to safely deploy IAM changes and minimize business disruption. 

Awareness and Training: 

• Provide guidance to admins and end users on secure access practices (MFA, Conditional Access behavior, guest collaboration). 

• Create and maintain clear internal documentation for access requests, privileged access workflows, and review procedures.