Manager Consultant - AD / Entra

Role Overview

The Manager, Identity & Access Management, leads the design, delivery, and modernization of enterprise identity platforms spanning on-premises Active Directory and Microsoft Entra ID. The role provides strategic vision and hands on technical leadership across directory consolidation, migration, and Zero Trust identity programs for large, complex enterprise environments. Managers own delivery quality, coordinate cross functional teams across multiple regions and time zones, manage stakeholder relationships, and develop junior team members.

Key Responsibilities

Delivery & Technical Leadership

• Lead the planning, architecture, and execution of Active Directory and Entra ID engagements, including upgrades, migrations, consolidations, and greenfield deployments.
• Own end to end delivery quality, timelines, and risk management across concurrent workstreams and regions.
• Provide technical direction on directory design, migration methodology, wave/band planning, and cutover execution.
• Handle escalated technical issues and deliver root cause analysis (RCA).

Strategy & Advisory

• Develop IAM strategy and transformation roadmaps covering operating model, governance, policies, and standards.
• Advise clients on Zero Trust, least privilege, and defense in depth identity control frameworks aligned to NIST and CIS.
• Translate business and regulatory requirements into practical identity architecture and controls.

People & Stakeholder Management

• Coach, counsel, and review the work of Consultants and Senior Consultants; contribute to performance feedback and a ‘EY trusted advisor’ culture.
• Build and maintain productive client relationships and coordinate stakeholders across global time zones.
• Support business development, proposals, and expansion of existing engagements.

Required Skills & Competencies

Candidates are expected to demonstrate deep, hands on capability across the following domains:

On-Prem Active Directory

Forest/domain design, OU & GPO architecture, DNS/DHCP, sites & replication, FSMO roles, ADCS/PKI, Kerberos, backup/restore, DC promotion.

AD Migration & Consolidation

Domain to domain and cross forest migrations, domain consolidation, SID history, wave planning, group scope conversion (Global→Universal), objectGUID/DN handling, ADMT/third-party tooling.

Entra ID (Azure AD)

Tenant administration, Entra Connect/Cloud Sync, hybrid identity, app registrations, SSO/SAML/OAuth/OIDC, unified identity management.

Conditional Access & MFA

CA policy design to Microsoft baseline, sign in/user risk conditions, device compliance, CAE, MFA operations, passwordless (WHfB, FIDO2/passkeys, TAP).

Privileged Identity Mgmt

PIM JIT activation, approval workflows, access reviews, standing privilege reduction, audit trails (Entra ID P2 / Governance licensing).

Identity Governance

HR driven JML provisioning (Workday/SuccessFactors/UKG), Access Packages, entitlement management, access reviews, Lifecycle Workflows for B2B/contingent.

Identity Protection & Monitoring

Risk based policies, SIEM/Sentinel integration (KQL, Logic Apps), anomaly detection, security reporting.

Scripting & Automation

PowerShell (AD & Graph), LDAP query construction, automation of migration and reporting tasks.

Adjacent Platforms

SailPoint, Saviynt, Radiant Logic, ServiceNow/ITSM, CyberArk, RBAC/ABAC, PKI, federation.

Qualifications & Experience

• Bachelor's or Master's degree in Computer Science, Information Systems, Cybersecurity, or a related field (or equivalent experience).
• 8+ years in identity/directory services, with 3+ years leading teams or engagements at a managerial level.
• Demonstrated experience delivering large scale AD migration/consolidation and hybrid identity programs.
• Strong verbal and written communication, technical documentation, and executive stakeholder engagement.

Preferred Certifications

• Microsoft Certified: Identity and Access Administrator Associate (SC-300)
• Microsoft Certified: Azure Administrator Associate (AZ-104); Security, Compliance, and Identity Fundamentals (SC-900)
• Legacy AD certifications valued: MCSA / MCSE / MCITP Server Administrator
• Relevant governance/vendor credentials: SailPoint, CyberArk, ITIL

Success Measures

• On time, on budget delivery with measurable milestones (ex: domains retired, consolidated, migrated, standing privileges reduced, JML automation coverage).
• High client satisfaction and demonstrable improvements in identity security posture.
• Effective team development, utilization, and quality outcomes across engagements.

Pay: $155,000.00 - $185,000.00 per year

Benefits:

• 401(k) matching
• Dental insurance
• Health insurance
• Vision insurance

Experience:

• identity and directory services: 8 years (Required)
• leading IAM teams or engagements as manager: 3 years (Required)
• hands-on AD migration and consolidation: 3 years (Required)
• Microsoft Entra ID (Azure AD): 3 years (Required)
• hybrid AD/Entra ID identity: 3 years (Required)
• designing and implementing Conditional Access and MFA: 2 years (Required)

Work Location: Remote