Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 14 days ago

Entra ID Engineer Consultant - Access Management & Identity Governance

Kalles Group10 open roles

Pay
$135,000 – $155,000 a year
Where
Seattle, WA
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowEntra ID Engineer Consultant - Access Management & Identity GovernanceKalles Group · Seattle, WA

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Kalles Group's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.4% of postings close within 7 days. Measured by our own scanner across the market. Kalles Group postings stay open a median of 18 days.

Share of postings closed within
  1. 2.2%1 day
  2. 4.6%3 days
  3. 13.4%7 days
  4. 21.6%14 days
  5. 36.2%30 days
  6. 59.0%60 days
This job: posted 14 days ago

Kalles Group median: 18 days open

The posting

ABOUT KALLES GROUP:

Everyone deserves to be secure. Our mission at Kalles Group is to help secure the future for companies of all shapes and sizes.

While our expertise spans multiple disciplines, our method remains consistent: building trust and relationship with people -- whether you are a client, a consultant, or--in this case--a candidate.

No matter what role you come from--whether you're an executive or just starting your career-you can expect our highest level of attention and respect. We want to find the right fit for each role, but we also want you to find the right fit for your career.

We believe the best way to show you what our team is like is to treat you like you're already a part of it. We hope you'll consider joining our team of experienced professionals who are building their careers at Kalles Group—and having fun while doing it.

WHAT YOU WILL DO:

As a Senior Microsoft Entra ID Engineer, you’ll be on assignment with one of our enterprise clients, helping lead a large workforce identity migration. Authentication for thousands of applications, including many complex SAML integrations, is moving from a legacy identity provider to Microsoft Entra ID. You’ll own the design, build and operation of access management and identity governance in Entra, and you’ll have a lot of autonomy. Your work will include Conditional Access and authentication strategy (phishing-resistant MFA and passwordless), Privileged Identity Management, application SSO and provisioning, B2B access, and the full Entra ID Governance suite: entitlement management, access reviews and lifecycle workflows. You’ll make Entra-native governance work cleanly alongside SailPoint Identity Security Cloud and hybrid Active Directory, and you’ll automate with Microsoft Graph, PowerShell and Infrastructure as Code. You’ll also set engineering standards and mentor other engineers on the team.

KEY RESPONSIBILITIES:

ACCESS MANAGEMENT (Entra ID)

• Design and maintain Conditional Access architecture – persona/risk-based policies, device & location conditions, session controls, Authentication Strengths for phishing-resistant MFA.

• Own authentication methods strategy and rollout – passwordless/FIDO2/passkeys, Windows Hello for Business, certificate-based auth; retire weaker methods.

• Administer Privileged Identity Management (PIM) – eligible assignments, JIT activation, approvals, privileged role & PIM-for-groups reviews.

• Manage application access – enterprise app SSO (SAML/OIDC), app role assignments, SCIM provisioning.

• Design external identity / B2B controls – cross-tenant access settings, guest governance, partner access patterns.

IDENTITY GOVERNANCE (Entra ID Governance)

• Build and operate Entitlement Management – access packages, catalogs, policies, approval/expiration workflows, separation-of-duties checks.

• Design and run Access Reviews across groups, apps, privileged roles and guests, including recurring/automated reviews with auto-remediation.

• Implement Lifecycle Workflows – HR-driven joiner/mover/leaver and scheduled governance tasks.

• Configure HR-driven inbound provisioning and outbound SCIM app provisioning.

• Integrate Entra-native governance with SailPoint ISC and hybrid AD, defining ownership boundaries and avoiding duplicate controls.

ACROSS THE ROLE

• Automation and config-as-code (PowerShell, Microsoft Graph API / Graph PowerShell SDK, Terraform/Bicep).

• Produce reference designs, standards and documentation; review other engineers' designs/configs.

• Partner with SecOps so identity telemetry supports threat detection.

• Mentor engineers; act as Entra access/governance SME. Use AI tooling to accelerate design and documentation.

ABOUT YOU:

Your values:

  • Integrity: You believe in doing the right thing, even when it's uncomfortable, seemingly inefficient, or costly. Purposefulness: You have a desire to serve others with your skillset and an openness to continuous learning and growth. Ownership: You stick to your commitments, follow up with action, and seek clarity in communication & expectations.

YOUR EXPERIENCE:

Required Qualifications

• Bachelor's/master's in CS, Cybersecurity, IT, or equivalent experience.

• 4+ years in IAM or security engineering with a track record leading technical projects.

• Deep hands-on Microsoft Entra ID: Conditional Access, authentication methods, PIM, Entra ID Protection.

• Hands-on Entra ID Governance: entitlement management (access packages), access reviews, lifecycle workflows.

• Expert knowledge of SAML, OAuth 2.0, OIDC, SCIM and their security implications.

• Hybrid identity: Entra Connect / Cloud Sync with on-prem AD; governing access across both.

• Automating Entra via Microsoft Graph API / Graph PowerShell SDK; PowerShell, Python; Terraform or Bicep.

• System-level design thinking; able to set standards others build against.

• Clear communication with engineers and stakeholders; operates autonomously in a fast-paced environment.

Preferred Qualifications

• Certifications: SC-300, SC-100, AZ-500, CISSP, or SailPoint.

• Entra governance alongside an enterprise IGA (SailPoint IdentityNow / ISC).

• PAM familiarity (e.g., BeyondTrust) and how PAM and PIM complement each other.

• External/B2B identity at scale, cross-tenant collaboration, guest governance.

• ITDR exposure; feeding identity signals into SIEM/SOAR.

• Entra Verified ID, Permissions Management, or Global Secure Access.

• Large-scale retail, ecommerce, or high-transaction enterprise experience.

WHAT WE OFFER:

  • The annual salary range for this role is $135,000-$155,000.
  • We offer Medical, Dental, Vision plans, 401K with matching, and PTO for salaried employees.
  • Work/life balance – we know there’s more to life than work! We encourage our team to pursue other passions, get outside, and spend time with family. We work with clients and consultants to set expectations for a manageable workload.

LOCATION:

This role is hybrid with onsite requirements at our client's location in Seattle, WA. Therefore, we are currently only considering candidates that are already living in the Seattle area.

HOW TO APPLY:

Please fill out the form below (including uploading your most recent resume) and we'll be in touch! We know imposter syndrome can be a barrier to many great applicants. We hope you'll still consider applying. That's why we've made the application process as short and simple as possible.

Even if you're not a fit for the role, you can expect to hear back from us! We want you to have the best experience as a candidate, so please feel free to share feedback at any stage of the process to [email protected].

Kalles Group is an equal-opportunity employer and does not discriminate on the basis of creed, nationality, race, ethnicity, disability, gender, or other protected class.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Kalles Group's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Kalles Group's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Kalles Group's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.