Identity & Access Management Specialist

The Identity Management Specialist is responsible for designing implementing and operating the firms identity and access management (IAM) program across on-premises and cloud environments with a strong emphasis on Microsoft Entra ID and hybrid identity architectures. This role administers the full identity lifecycle joiner mover leaver (JML) - enforces least-privilege access automates provisioning and governance and ensures that every user service account and privileged identity is provisioned reviewed and deprovisioned in a controlled auditable manner across both on-premises Active Directory and the Entra ID cloud.

• Operate and enhance the JML (Joiner / Mover / Leaver) process across Active Directory Entra ID Exchange M365 and downstream business applications.
• Automate provisioning role changes and deprovisioning through identity management solutions (One Identity Manager ServiceNow ManageEngine ADManager Plus Cayosoft Administrator or others).
• Manage Active Directory and Entra ID objects (users groups OUs contacts mail-enabled objects) at scale using identity management solutions.

• Design operate and troubleshoot hybrid identity across on-premises Active Directory and Microsoft Entra ID including Entra Connect / Connect Sync / Cloud Sync password hash sync (PHS) pass-through authentication (PTA) federation (AD FS) and seamless SSO.
• Administer multi-domain / multi-forest Active Directory Entra ID tenants and B2B/B2C scenarios.
• Manage Conditional Access Entra ID Protection Privileged Identity Management (PIM) Access Reviews and Entra ID Governance.
• Maintain hybrid object flow attribute mapping filtering and writeback (group device password writeback).

• Design and execute periodic access certification campaigns (One Identity Manager / ServiceNow Access Reviews / Entra ID Access Reviews) for high-risk applications shared mailboxes distribution lists and privileged groups.
• Maintain role-based access control (RBAC) models entitlement catalogs and segregation of duties (SoD) policies.
• Investigate and remediate orphaned accounts stale entitlements and policy violations.

• Own the IAM request catalog in ServiceNow new accounts group membership changes application access privileged access and terminations.
• Build and maintain ServiceNow workflows IntegrationHub / Flow Designer flows and approval routings that connect HRIS ITSM and identity systems.
• Implement self-service password reset MFA enrollment and account unlock through Entra ID SSPR.

• Administer privileged and service accounts across AD and Entra ID; integrate with PAM solutions where applicable.
• Use privilege accounts password management solution for delegated administration change auditing AD recovery and Entra ID tenant management.

• Monitor identity-related alerts sign-in risk events and Conditional Access policy enforcement.
• Produce metrics and reports for audit risk and leadership provisioning SLAs access review completion dormant accounts privileged access usage.
• Support compliance evidence collection for SOC 2 ISO 27001 NYDFS Part 500 GDPR and client security questionnaires.

• Partner with HR Security Infrastructure and Application owners on onboarding/offboarding and role design.
• Maintain runbooks SOPs integration designs and architecture diagrams for the IAM platform.
• Provide L3 support and mentor L1/L2 service desk staff on identity issues.

Compensation: -The anticipated base salary range offered for this role will be between $140000 to $160000 and represents the firms good faith and reasonable estimate of the range of possible base compensation. Actual base compensation will be dependent upon several factors including but not limited to the candidates relevant experience performance qualifications degrees and location well as the needs of the firm.

• Bachelors degree in Computer Science Information Systems or related field (equivalent experience accepted).
• 5 years of hands-on Identity and Access Management experience across hybrid Microsoft environments (Active Directory Entra ID / Azure AD).
• Strong working knowledge of Microsoft Entra ID (Azure AD) and hybrid identity models including Entra Connect / Connect Sync / Cloud Sync password hash sync pass-through authentication federation (AD FS) seamless SSO Conditional Access MFA Entra ID Protection Privileged Identity Management (PIM) Access Reviews Entra ID Governance and Enterprise Application SSO/provisioning.
• Deep demonstrable experience with the following IAM/IGA toolset:
  • One Identity Manager (OneIM) connectors synchronization projects attestation/access reviews custom workflows IT Shop role and entitlement modeling and PowerShell/SQL customization.
  • ServiceNow IAM service catalog workflow / Flow Designer IntegrationHub ITSM integration with identity systems and ideally ServiceNow Identity Governance & Administration (SN-IGA) or HR Service Delivery integrations.
  • ManageEngine ADManager Plus bulk AD/Entra ID administration automation policies custom reports self-service password reset/MFA and delegation.
  • Cayosoft Administrator and Cayosoft Guardian hybrid AD/Entra ID administration change monitoring AD object recovery and tenant management.
• Solid understanding of Active Directory Group Policy Kerberos LDAP SAML OAuth 2.0 OIDC and SCIM.
• Scripting and automation proficiency in PowerShell (AD Exchange Online Microsoft Graph Entra ID / MSOnline / AzureAD modules); familiarity with REST APIs and JSON.
• Solid understanding of RBAC ABAC least privilege segregation of duties and identity lifecycle controls.

• Experience integrating IAM with HRIS platforms (Workday) as authoritative source for JML.
• Exposure to additional IAM/IGA/PAM platforms (SailPoint IdentityIQ / OneIdentity. Saviynt CyberArk BeyondTrust Delinea Microsoft Entra ID Governance).
• Experience with SaaS provisioning via SCIM and Entra ID Enterprise Applications.
• Industry certifications: SC-300 (Microsoft Identity and Access Administrator) One Identity Manager certifications ServiceNow CIS-ITSM / CIS-SecOps CISSP CIAM or equivalent.
• Experience in a law firm financial services or other highly regulated environment.