Identity Access Management Engineer (IT Services)

About Charles River Associates

Charles River Associates is a leading global consulting firm that provides economic, financial, and business management expertise to major law firms, corporations and governments around the world. CRA advises clients on economic and financial matters pertaining to litigation and regulatory proceedings, and guides corporations through critical business strategy and performance-related issues. Since 1965, clients have engaged CRA for its combination of industry experience and rigorous, fact-based analysis that provide clients with clear, implementable solutions to complex business concerns.

Position Overview

The Information Technology (ITS) team at CRA is currently a Global team of 40 professionals dedicated to enhancing, maintaining, and developing the firm's technology infrastructure and security. The team is comprised of four functions: Service Delivery & Telecom, Enterprise Application Solutions, Infrastructure, Networking and Cloud Services and Security. Information Technology staff are based in the Boston, Chicago, London, Munich, New York, Oakland, and Washington, DC offices. Mainly a Microsoft house, CRA is looking to maximize the performance of our on-premise systems and hybrid infrastructure, meaning experience with cloud technologies is essential for this role.

The Identity Access Management Engineer is responsible for the design, implementation, and operational support of enterprise identity and access management solutions with a primary focus on the Microsoft Entra platform. This role serves as the subject matter expert (SME) for identity security, privileged access management, identity governance, and non-human identities (NHIs), ensuring secure and compliant access to enterprise resources across hybrid and cloud environments. This position plays a key role in advancing CRA's hybrid cloud strategy through Identity platform standardization, identity governance, and assist in automation-first operational workflows/practices.

As an IAM Engineer you will help drive the adoption of Microsoft security best practices and modern identity architectures, leveraging Microsoft Entra ID, Entra ID Governance, Privileged Identity Management (PIM), Conditional Access, Identity Protection, and related Microsoft security services. Coordination across other teams within the IT department and across the firm, and some travel to other CRA offices will be expected. Some out-of-hours and weekend work will be required for scheduled upgrades and in response to unexpected outages. Typical responsibilities include:

Identity Platform Engineering

• Design, implement, and maintain enterprise identity solutions across Microsoft Entra ID, Active Directory, and hybrid identity environments

• Architect secure authentication and authorization services leveraging Entra ID, Conditional Access, Identity Protection, MFA, and Privileged Identity Management (PIM)

Automation & Identity Lifecycle Management

• Develop and maintain automation solutions using PowerShell, Azure rest APIs, Graph, and JWT tokens

• Automate identity provisioning, deprovisioning, access certification, credential rotation, and governance processes

• Create integrations with enterprise systems to improve identity operations and reduce manual administration

Cloud Enablement, Operations & Support

• Provide operational support for Microsoft Entra and Active Directory services, ensuring availability, reliability, and security

• Monitor, troubleshoot, and resolve complex identity, authentication, synchronization, and access-related issues

• Collaborate with Cloud, Infrastructure, Security, and Application teams to onboard and secure enterprise applications;

Identity Security, Governance & Compliance

• Establish and maintain identity security standards, operational procedures, and access control policies

• Support audit, compliance, and regulatory requirements through effective identity governance and privileged access controls

• Identify and remediate identity-related risks in alignment with Zero Trust and Microsoft security best practices

Desired Qualifications

• Bachelor's degree (Master's desirable) in Computer Science, Information Systems or related discipline;

• 8-10 years of prior hands-on professional experience with the most recent years as an IAM Engineer

• Proven experience in designing, deploying, and managing an enterprise PAM environment with specialized knowledge related to Thycotic, CyberArk, or Microsoft privileged access solutions.

• Automated identity lifecycle processes using PowerShell, Microsoft Graph API, Azure Automation, Logic Apps, or related automation platforms.

• Implemented and supported Microsoft Entra ID, Entra ID Governance, Privileged Identity Management (PIM), and Conditional Access policies in enterprise-scale environments.

• Hands-on experience with hybrid identity architectures, including Active Directory Domain Services (AD DS), Entra Connect, Cloud Sync, and federated authentication services.

• Experience implementing and managing Single Sign-On (SSO) integrations using SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), and SCIM

• Demonstrated ability in removing standing privilege by leveraging just-in-time access or other dynamic elevation models

• Hands-on experience with cloud migrations while managing complex hybrid Active Directory environments

• Knowledge of regulatory and security frameworks including NIST, CIS Controls, ISO 27001, and Zero Trust security standards.

• Must be comfortable in customer-facing scenarios and effectively collaborating in cross-functional technical teams;

• Self-motivated, with a strong ability to prioritize and execute tasks in a high-pressure environment;

• Ability to travel to other offices and execute project plans with minimal oversight.

Additional Preferred Skills

• Experience with VMware Cloud Foundation (VCF), vSphere, and hybrid cloud architectures.

• Microsoft Certified: Identity and Access Administrator Associate (SC-300) or Azure Solutions Architect Expert (AZ-305), or related Cloud Identity certifications.

• Experience with Identity Threat Detection and Response (ITDR), identity security monitoring, and integrations with Microsoft Defender and Microsoft Sentinel.

• Experience integrating AIOps, observability, or monitoring platforms.

To Apply

To be considered for the this position, we require:

• Resume – please include current address, personal email and telephone number;

• Cover letter (optional) – please describe your interest in CRA and how this role matches your goals. Also, please note if you have interest in a particular practice and/or a location preference.

Career Growth and Benefits

• CRA’s robust skills development programs , encompassing both formal and informal programs, encourage you to thrive as an individual and team member. Training includes technical training, presentation skills, internal seminars, and career mentoring and performance coaching from an assigned senior colleague. Additional leadership and collaboration opportunities exist through internal firm development activities.

• We offer a comprehensive total rewards program including a superior benefits package, wellness programming to support physical, mental, emotional and financial well-being, and in-house immigration support for foreign nationals and international business travelers.

Work Location Flexibility

CRA creates a work environment that enables our colleagues to benefit from being together in the office to best deliver on our promise of career growth, mentorship and inclusivity. At the same time, we recognize that individuals realize a range of benefits when working from home periodically. We currently expect that individuals spend at least 3 to 4 days a week working in the office (which may include traveling to another CRA office or to client meetings), with specific days determined in coordination with your practice or team.

Responsible AI Use in Recruiting

…