Note: The job is a remote job and is open to candidates in USA. S&C Electric Company is an industry leader focused on advancing safe, reliable, and resilient electrical grids. The Lead Identity Security Engineer will design, implement, and govern enterprise identity and access management capabilities across on-premises, cloud, and hybrid environments, with an initial focus on Microsoft Entra ID and Active Directory. The role will lead identity architecture, privileged access, identity governance, threat detection, risk assessment, and cross-functional security initiatives.
Responsibilities
- Define and maintain the identity security strategy, reference architectures, technical standards, and roadmap aligned with MCRA, Zero Trust, cybersecurity risk priorities, and business needs
- Design secure, scalable identity and access management solutions across on-premises, cloud, and hybrid environments, with clear separation between governance, engineering, administration, and monitoring responsibilities
- Govern the identity architecture and control posture for Microsoft Entra ID, Active Directory, cloud synchronization, and related identity services
- Architect authentication and authorization capabilities, including SSO, federation, MFA, passwordless authentication, Conditional Access, session controls, and risk-based access
- Design privileged access controls, including PIM/PAM, just-in-time access, administrative tiering, emergency access, service-account governance, and least-privilege operating models
- Develop role-based and attribute-based access models, segregation-of-duties controls, entitlement standards, and secure access patterns for enterprise applications and platforms
- Lead identity lifecycle and governance improvements, including joiner-mover-leaver processes, provisioning and deprovisioning automation, SCIM integrations, access reviews, recertification, guest access, and non-human identity governance
- Partner with Identity Administration on implementation and operational execution while maintaining architecture, standards, and control design ownership within Identity Engineering
- Participate in security architecture, project, and change reviews to ensure identity security requirements are designed into new applications, platforms, and business processes
- Engineer identity threat detection and response enablement, including log architecture, telemetry collection, detection content, analytics, dashboards, and integrations across Defender for Identity, Sentinel, SIEM/SOAR, PAM, and related platforms
- Build and tune identity detections and response automation with Cybersecurity Operations, which owns continuous monitoring, investigation, escalation, and incident response
- Assess identity risk by analyzing authentication patterns, risky identities, privileged-access exposure, stale or orphaned accounts, control exceptions, and detection coverage; translate findings into practical remediation plans
- Define identity metrics, reporting, and evidence standards that demonstrate control effectiveness, governance performance, risk reduction, and roadmap execution for audit, compliance, client assurance, and cyber insurance needs
- Evaluate identity and ITDR technologies, lead proofs of concept and vendor assessments, and drive initiatives from strategy through implementation and transition to operations
- Develop and maintain architecture diagrams, standards, control designs, implementation guidance, operating procedures, and playbooks; provide technical leadership and mentorship across IT
- Protect Firm and client information by complying with information security policies, exercising sound judgment, and promptly reporting security events, control failures, or material risks
Skills
- 6 to 10 years of progressive experience in identity and access management, identity security engineering, security engineering, or a closely related discipline
- Demonstrated experience serving as a senior technical lead for enterprise identity initiatives, including hands-on delivery in complex Microsoft identity environments
- Deep knowledge of identity security architecture and engineering across Microsoft Entra ID, Active Directory, and hybrid identity environments
- Advanced experience with MFA, SSO, federation, Conditional Access, PIM/PAM, RBAC/ABAC, identity lifecycle governance, access reviews, and least-privilege design
- Demonstrated ability to design enterprise identity controls while preserving clear boundaries between architecture and governance, platform administration, and security monitoring
- Experience engineering identity security telemetry and detection capabilities, including Entra ID and Active Directory logging, Microsoft Defender for Identity, Microsoft Sentinel or comparable SIEM, SOAR automation, and identity analytics
- Strong understanding of identity attack paths and common threats, including credential theft, token abuse, privilege escalation, lateral movement, legacy authentication, excessive privilege, and persistence through identity systems
- Proficiency with automation and integration technologies such as PowerShell, Python, Microsoft Graph and other APIs, infrastructure-as-code, and structured data formats
- Ability to translate cybersecurity risk and technical complexity into clear standards, decisions, roadmaps, and executive-ready communications
- Proven ability to lead complex cross-functional initiatives, influence without direct authority, manage competing priorities, and drive issues through resolution
- High degree of discretion, integrity, attention to detail, and commitment to client service and professional excellence
- Bachelor's degree in Cyber Security, Information Systems Management, Computer Science, Computer Engineering, Cloud Security or equivalent experience
- Experience in a global, highly confidential, regulated, manufacturing, or professional-services environment
- Working knowledge of cloud security, networking, PKI and certificates, application architecture, and security operations, supported by strong analytical, troubleshooting, documentation, presentation, and stakeholder-management skills
- Microsoft Certified: Identity and Access Administrator Associate (SC-300), Azure Security Engineer Associate, or comparable Microsoft identity certification (within 6 mos)
- CISSP, CISM, CCSP, or a comparable information security certification
- Advanced certification in a relevant PAM, IGA, ITDR, SIEM/SOAR, or cloud platform is a plus
Benefits
- This role is also eligible for S&C’s annual incentive plan (AIP), subject to eligibility criteria.
- Workplace Type: Remote
- Health and Welfare Benefits: Medical & Prescription, Dental, Vision, Health Care and Dependent Care Flexible Spending Accounts, Health Savings Account (HSA), Group Life Insurance, optional Supplemental Life and AD&D Insurance, Wellbeing Resources including Employee Assistance Program and Family Forming Benefits (i.e., Adoption and Fertility support)
- Leave Benefits: Vacation Time, Sick Time, Paid Holidays and Company Shutdown days, Short-Term Disability, Long-Term Disability, Other Leaves, Paid Parental Time and Military Leave
- 401(k) Retirement Savings and Employee Stock Ownership Plan (KSOP) offering traditional and Roth 401(k) options and an Employee Stock Ownership Plan (ESOP) component
- KSOP participants can receive annual ESOP company contributions of over 11% of eligible earnings (3% Core, up to 3.5% Match, Variable Periodic).
- Team members advance their careers through robust talent-development programs and involved leadership
Company Overview
Company H1B Sponsorship