Senior Identity & Conditional Access Security Architect/SME

System Soft Technologies seeks a Senior Identity & Conditional Access Security Architect/SME to lead enterprise identity security architecture and Microsoft Entra Conditional Access. The role assesses identity environments, designs and governs security policies, documents architecture and risk, and presents recommendations to senior security leadership.

Responsibilities

• Own the end-to-end architecture and design of Microsoft Entra Conditional Access policies
• Assess existing Conditional Access policies and identify gaps, overlaps, conflicting controls, exclusions, security risks, and opportunities for consolidation
• Design Conditional Access policies based on:
• User/group identity
• Administrative and privileged roles
• Applications and cloud resources
• Device compliance
• Device platforms
• Network/location conditions
• Authentication strength
• Sign-in risk
• User risk
• Workload identities where applicable
• Design policies addressing scenarios such as:
• Require MFA
• Phishing-resistant MFA
• Block legacy authentication
• Require compliant or managed devices
• High-risk sign-in/user controls
• Administrative portal protection
• Guest/B2B access
• Service and emergency access scenarios
• Geographic/location restrictions
• Session controls
• BYOD access
• Develop an enterprise Conditional Access strategy and policy architecture aligned with Zero Trust principles
• Create clear current-state and future-state architecture diagrams
• Produce an executive-level Conditional Access proposal explaining:
• Current security gaps
• Proposed policies
• Threat/risk addressed by each policy
• Business impact
• User experience impact
• Exception strategy
• Rollout approach
• Testing methodology
• Rollback procedures
• Risk reduction and expected security outcomes
• Present the Conditional Access design and recommendations directly to the CISO, security leadership, IAM leadership, architecture review boards, and other senior stakeholders
• Translate highly technical identity-security concepts into clear business-risk language suitable for executive decision making
• Architect and strengthen Microsoft Entra ID identity-security capabilities
• Design and implement MFA, authentication strengths, PIM, Identity Protection, RBAC, JIT access, B2B access, and Identity Governance
• Apply Zero Trust principles across workforce, privileged, guest, and application access
• Define least-privilege and privileged-access strategies
• Partner with SOC and security teams to incorporate identity risk and suspicious sign-in signals into security operations
• Establish a structured lifecycle for policy design → review → Report-only mode → pilot → validation → production rollout → monitoring → optimization
• Define policy naming conventions, documentation standards, ownership, exception management, and change-control processes
• Establish dedicated break-glass/emergency access account architecture and monitoring
• Analyze sign-in logs and Conditional Access results before enforcement
• Ensure policies do not inadvertently disrupt administrators, service identities, business-critical applications, or approved access scenarios
• Define periodic policy review and recertification processes
• Align identity controls with relevant enterprise security frameworks including NIST, CIS, ISO 27001, SOC 2, PCI DSS and Zero Trust principles
• Maintain architecture diagrams, security standards, implementation guides, policy matrices, decision records, and security-control documentation
• Partner with Cloud Security, SOC, IAM, Endpoint, Infrastructure, Network, GRC, Application Security and business teams

Skills

• The ideal candidate must be capable of independently assessing the current identity environment, designing a comprehensive Conditional Access Policy framework , documenting the architecture and security rationale, evaluating business and operational impact, and presenting the proposed strategy directly to the CISO and senior security leadership for review and approval
• This person will serve as the technical authority for Microsoft Entra ID, Conditional Access, Zero Trust Identity, MFA, PIM, Identity Protection, privileged access, and identity governance
• The profile should combine deep hands-on technical expertise with strong architecture documentation and executive-level communication skills
• Demonstrates experience with Microsoft Entra/Azure AD, B2B/B2C, RBAC, PIM, Conditional Access, MFA, JIT, Identity Protection and Zero Trust policy design, making these appropriate core requirements for the role
• Align identity controls with relevant enterprise security frameworks including NIST, CIS, ISO 27001, SOC 2, PCI DSS and Zero Trust principles
• The reference profile also demonstrates architecture/governance work against NIST, ISO 27001, CIS, SOC 2, PCI DSS, SOX, HIPAA and GDPR, with experience creating architecture documentation and governance frameworks

Company Overview

Company H1B Sponsorship