Role summary

You will own how identity and privileged access are designed and governed across a hybrid Microsoft estate. As part of a zero-trust program, and building on lessons from recent identity incidents, you will define a tightened privileged access model in Entra ID and on-prem AD, set the policies and standards, and hold teams to them through reviews and governance. You are the policy owner and design authority; platform teams implement and operate under your direction.

Key responsibilities:

Privileged access architecture

- Design and own the privileged access model based on Microsoft's Enterprise Access Model (control, management and user/workload planes), covering Entra ID and on-prem AD.

- Define standards for Privileged Identity Management (PIM): just-in-time, time-bound elevation, approval workflows, justification, MFA on activation, and PIM for Groups.

- Minimize standing privilege: remove permanent Global Administrator and other high-impact role assignments, apply least-privilege and custom roles, and use administrative units and restricted management where suitable.

- Define emergency access (break-glass) accounts, privileged access workstation requirements and secure admin pathways.

Identity controls and zero trust

- Design the Conditional Access framework: baseline policies, admin-specific policies, device compliance, location and risk conditions, authentication strengths and session controls.

- Drive phishing-resistant authentication (FIDO2 keys, passkeys, Windows Hello for Business, certificate-based authentication) for all privileged users.

- Use Entra ID Protection user and sign-in risk signals, and define responses to risky identities.





- Govern hybrid identity: Entra Connect / Cloud Sync security, AD tiering, Tier 0 protection and hardening against common AD attacks.

Non-human and workload identities

- Set policy for service principals, managed identities, app registrations and enterprise apps: ownership, credential hygiene, secret and certificate rotation, and workload identity federation in place of secrets.

- Control application consent and high-privilege API permissions (for example, Microsoft Graph) to block consent phishing and over-privileged apps.

- Govern on-prem service accounts and group Managed Service Accounts.

Identity governance and review policies

- Design and run access reviews for privileged roles, groups, guest users and applications, with clear reviewers, cadence and auto-remediation.

- Define joiner-mover-leaver controls with Entra ID Governance (entitlement management, access packages, lifecycle workflows).

- Maintain identity security policies, standards and exceptions; align with ISO 27001, DPDP Act and healthcare/GxP audit requirements.

- Report identity risk and control health: standing privilege counts, PIM adoption, phishing-resistant MFA coverage, review completion and stale accounts.

Incident support

- Act as identity expert in incidents involving compromised accounts, token theft,



privilege escalation or malicious consent, and lead the identity root cause and control fixes.

Must-have skills

- 10+ years in IAM/identity security, with deep Entra ID and Active Directory security expertise.

- Proven design and rollout of PIM, Conditional Access and access reviews at enterprise scale.

- Strong understanding of identity attacks (AiTM phishing, token replay, consent phishing, Kerberos attacks, DCSync) and the controls that stop them.

- Hybrid identity architecture: Entra Connect / Cloud Sync, AD tiering and Tier 0 protection.

- Experience writing identity policies and standards and winning adoption from IT and business teams.

- Strong documentation and stakeholder communication.

Valuable to have

- Entra ID Governance (entitlement management, lifecycle workflows) and Entra ID Protection in production.

- Identity threat detection tooling (for example, CrowdStrike Falcon Identity Protection or Microsoft Defender for Identity).

- Automation with Microsoft Graph and PowerShell for identity reporting.

- Experience in regulated industries, ideally healthcare or pharma.

- Certifications: SC-300, SC-100, AZ-500, CISSP, or equivalent.

- Looking for Immediate Joiners

What success looks like in 12 months

- No permanent Global Administrators outside break-glass accounts; all privileged roles eligible through PIM.

- 100% of privileged users on phishing-resistant authentication.

- Quarterly access reviews running for all privileged roles, with completion tracked.

- Workload identities inventoried, owned, and moved off long-lived secrets where possible.

📌 Privileged Access & Identity Security Architect - Entra ID (Bengaluru)
🏢 Neurealm
📍 Bengaluru