Identity and Access Management Specialist

The Identity & Access Management (IAM) Specialist owns day-to-day identity and access operations for several thousand users across multiple Microsoft Entra tenants, Active Directory, Microsoft 365, and connected business applications. The specialist processes access requests; resolves sign-in, multifactor authentication (MFA), single sign-on (SSO), and application access issues; and maintains accurate records and least-privilege access.

This position is part of a two-person IAM engineering team. The Senior IAM Engineer provides architecture, design, technical direction, and production approval. The specialist configures, integrates, tests, documents, and troubleshoots solutions through completion within those approved designs. The role balances an interrupt-driven request queue with planned integrations, access reviews, automation, migrations, and security improvements. It is an early-career IAM role for someone who already has hands-on experience in a production Azure, Microsoft Entra, Microsoft 365, systems administration, or advanced technical support environment.

• Own daily triage and fulfillment of the IAM request queue, including approved security-group membership, Microsoft 365 groups, distribution lists, shared mailboxes, application assignments, and license changes.
• Perform ongoing license hygiene, including monthly reclamation of unused Microsoft 365 and third-party licenses, upkeep of group-based licensing, and license utilization reporting. Coordinate with the licensing team, procurement, and application owners on allocations, true-ups, and renewals.
• Troubleshoot sign-in, password, MFA, SSO, and application access issues using sign-in logs, audit records, service-management tickets, and documented testing. Resolve routine issues and escalate complex or non-standard problems with a clear record of findings.
• Execute employee and contractor joiner, mover, and leaver processes, including account provisioning, access changes, account disablement, and timely access removal.
• Validate user identity, business need, and required approvals before fulfilling access requests or resetting authentication methods. Maintain complete and accurate records of all changes.
• Administer identities and approved access across the Meriton hub tenant and operating-company Entra tenants, Active Directory, Microsoft 365, and connected business applications.
• Support role-based access control and least privilege by maintaining approved group memberships, access profiles, application permissions, and time-bound privileged assignments.
• Partner with Human Resources, the service desk, application owners, and business stakeholders to resolve provisioning discrepancies and access issues.
• Maintain IAM procedures, knowledge-base articles, ticket records, and operational documentation so work can be reviewed, repeated, and audited.

• Using designs and production approvals provided by the Senior IAM Engineer, stand up, configure, test, document, and troubleshoot SSO and automated provisioning integrations using SAML, OAuth 2.0, OpenID Connect, and SCIM.
• Support approved Conditional Access, MFA, authentication-method, passwordless, and Temporary Access Pass changes through configuration, testing, user communication, documentation, and troubleshooting.
• Monitor HR-driven provisioning, SCIM connectors, and scheduled automation for failures or attribute mismatches. Resolve routine problems and escalate issues that require architecture or policy changes.
• Assist with access reviews, entitlement reporting, remediation, guest-account recertification, stale-account cleanup, service-account governance, and emergency-access account verification.
• Use PowerShell, Microsoft Graph tools, and identity-management tools to generate reports, perform authorized updates, and reduce repetitive manual work.
• Maintain application and app-registration hygiene by tracking expiring certificates and secrets, missing owners, stale applications, and approved consent requests.
• Collect audit evidence and produce recurring IAM metrics, including stale accounts, MFA coverage, guest accounts, privileged assignments, and license utilization.
• Coordinate with Security Operations on identity-related alerts and investigations, including assisting with authorized account containment and recovery actions.
• Support cross-tenant synchronization, B2B collaboration, tenant consolidations, acquisitions, divestitures, migrations, and access cutovers under senior technical direction.
• Monitor Microsoft 365 and Entra change announcements and flag deprecations or feature changes that may affect the environment.
• Perform other duties and responsibilities as assigned.

• Trustworthy, honest, and transparent when handling privileged access, sensitive information, mistakes, risks, and approval records.
• Security-focused judgment, with the discipline to validate identity, authorization, scope, and approvals before making a change.
• Analytical troubleshooting skills and the ability to distinguish authentication, authorization, configuration, and user-experience problems.
• Service-oriented communication with technical teams, business stakeholders, and end users.
• Dependable follow-through, accurate documentation, and early escalation when work falls outside an approved design or procedure.
• Adaptability in balancing quick operational requests with planned project work as priorities change.
• Team-first approach suited to a two-person IAM team, including knowledge sharing and mutual support.
• Commitment to continuous learning in Microsoft identity, cloud security, authentication, and automation.

• Bachelor's degree in Information Technology, Cybersecurity, Information Systems, or a related field, or equivalent practical experience.
• Two or more years of relevant experience in identity and access management, Microsoft 365 or Azure administration, directory services, systems administration, cybersecurity, or advanced technical support. Equivalent hands-on experience will be considered in place of a strict year count.
• Hands-on experience administering users, groups, access, and authentication in Microsoft Entra ID, Active Directory, or Microsoft 365 in a production environment.
• Experience troubleshooting sign-in, MFA, SSO, or application-access problems using logs, audit records, testing, and service-management tickets.
• Working knowledge of IAM fundamentals, least privilege, role-based access control, MFA, Conditional Access, and identity lifecycle processes.
• Foundational knowledge of SAML or OpenID Connect and the ability to configure and test SSO integrations under an approved technical design.
• Strong written and verbal communication skills for documenting work, explaining access issues, and coordinating resolution.
• Ability to operate under privileged-access controls, including a dedicated administrative account, time-bound Privileged Identity Management activation, and no standing privilege, and ability to complete a background check.

• Relevant Microsoft identity, Azure, or security certifications, or CompTIA Security+. Certifications are preferred but not required.
• Experience with PowerShell, Microsoft Graph PowerShell SDK, or REST APIs for reporting and routine administration.
• Familiarity with SAML, OAuth 2.0, OpenID Connect, SCIM, Privileged Identity Management administration, access reviews, B2B guest access, and service-account lifecycle practices.
• Experience with HR-driven provisioning, identity automation, enterprise applications, app registrations, or certificate and secret lifecycle management.
• Experience working in an IT service-management platform such as ServiceNow, Jira Service Management, or Freshservice.
• Experience in a multi-tenant Microsoft 365 environment or supporting merger, acquisition, divestiture, or tenant-migration work.

• This hybrid position requires a candidate who is local to the Dallas-Fort Worth area and able to work from the Shared Services Office in Irving, Texas.
• The employee will work onsite each workday during the first two weeks for onboarding, then normally one day per week with remote work available on other days.
• Additional onsite attendance may be required for projects, incidents, meetings, or other business needs.
• There is no formal on-call rotation. Planned evening or weekend work may be required a few times per year for migrations, cutovers, or significant incidents.

The work environment characteristics described here are representative of those an employee encounters while performing the essential functions of this job. Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions. The workplace is in a corporate office environment and the temperature in the work environment is usually moderate. The position’s primary office is the Shared Services, Irving, TX office; however, telework or work at home, on the road, or in a satellite location for portions of the workweek may occur, depending upon project needs and requirements in coordination with your direct supervisor and/or most senior leader of your department.

The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. While performing the duties of this job, the employee is regularly required to use hands to operate the computer keyboard and telephone, reach with hands and arms. The employee frequently is required to stand, walk, and sit. The employee is occasionally required to climb or balance and stoop, kneel, crouch, or crawl. The employee must regularly lift and/or move up to 25 pounds. Specific vision abilities required by this job include close vision, distance vision, peripheral vision, depth perception, and ability to adjust focus.