System Administrator III

The Tier 3 Microsoft 365 Entra Administrator is a senior-level Identity & Access Management (IAM) professional responsible for securing, administering, and optimizing a hybrid identity environment spanning on‑prem Active Directory and Microsoft Entra ID. This role serves as the highest escalation point for identity-related incidents, leads advanced troubleshooting and root cause analysis, and drives identity security strategy aligned with Zero Trust principles.

The role has a strong emphasis on identity security, governance, and privileged access, working closely with Cybersecurity, Infrastructure, and Compliance teams. The Tier 3 Entra Administrator also mentors Tier 1–2 support, owns identity automation and governance improvements, and ensures audit-ready identity operations using tools such as ServiceNow and NetIQ.

• Must be local to Brentwood, TN or Denver, CO
• Act as the Tier 3 escalation point for complex Entra ID, hybrid identity, and authentication incidents.
• Lead resolution of high-severity identity outages and security incidents (authentication failures, MFA bypass attempts, Conditional Access issues).
• Perform detailed root cause analysis (RCA) and implement long-term corrective and preventive actions.
• Drive identity-related Problem Management activities within ServiceNow.
• Provide technical leadership, mentoring, and knowledge transfer to Tier 1–2 support teams.
• Administer and secure Microsoft Entra ID and on‑prem Active Directory in a hybrid configuration.
• Support and troubleshoot Entra Connect / Cloud Sync:
  • Attribute flow and sync rule issues
  • Duplicate object resolution (soft/hard match)
  • UPN, proxyAddress, and source anchor mismatches
• Partner with AD, PKI, networking, and endpoint teams to ensure identity dependencies remain secure and resilient.
• Identity Security & Zero Trust Enforcement (Primary Focus)
• Design, implement, and maintain Conditional Access policies with a security-first approach:
  • Risk-based access
  • Device and platform restrictions
  • Session controls and legacy authentication blocking
• Manage and optimize authentication methods, including:
  • MFA (Authenticator, FIDO2, WHfB, OATH, Temporary Access Pass)
  • Phishing-resistant authentication strategies
• Administer Privileged Identity Management (PIM):
  • Eligible role assignments
  • Approval workflows
  • Just-in-time access
  • Privileged access monitoring and alerts
• Investigate Entra ID Protection risk detections and coordinate remediation for risky users and sign-ins.
• Maintain and protect break-glass and emergency access accounts.
• Lead identity governance initiatives using:
  • Access Reviews
  • Entitlement Management / Access Packages
  • Lifecycle and joiner-mover-leaver processes
• Utilize NetIQ identity tools to support:
  • Identity lifecycle management
  • Role-based access models
  • Attestation and access certification workflows
• Ensure identity controls align with regulatory and audit requirements (SOX, SOC 2, ISO, HIPAA, etc.).
• Provide audit evidence, logging, and reporting for identity-related controls.

• Application Access & Single Sign-On (SSO)

• Integrate and secure enterprise and SaaS applications using Entra SSO:
  • SAML, OAuth 2.0, OpenID Connect
  • SCIM provisioning and deprovisioning
• Secure and manage:
  • App registrations and service principals
  • API permissions and consent models
  • Certificate and secret lifecycle management
• Troubleshoot federation, claims, and token-related issues
• ServiceNow & Operational Excellence
• Use ServiceNow for:
  • Incident, Problem, and Change Management
  • Identity request workflows and approvals
  • CMDB and service mapping related to identity services
• Improve operational maturity through:
  • Runbooks and SOPs
  • Monitoring and alerting enhancements
  • Identity-related SLAs and KPIs

• Automation & Continuous Improvement

• Automate identity operations using:
  • PowerShell
  • Microsoft Graph
  • Azure Automation / Logic Apps
• Reduce manual access administration and improve consistency through automation.
• Maintain version-controlled scripts and documentation.
• Continuously assess and improve identity security posture and architecture.