The IAM Level 3 Engineer serves as the senior technical authority responsible for the strategic evolution, optimisation, and governance of the organisation's Identity and Access Management ecosystem across on-premises and cloud platforms. Reporting to the IAM Service Owner, the role drives platform maturity, security enhancement, operational resilience, and technology modernisation initiatives across Active Directory, Microsoft Entra ID, hybrid identity services, privileged access management, authentication services, and certificate management platforms.

The role provides technical leadership for the design, standardisation, and continuous improvement of identity services, ensuring IAM capabilities remain secure, scalable, compliant, and aligned with organisational security and business objectives. Through deep technical expertise and architectural understanding, the IAM Level 3 Engineer leads the resolution of complex identity challenges, eliminates systemic service issues, reduces technical risk, and enhances the effectiveness of identity governance and access control frameworks.

Working closely with Cyber Security, Infrastructure, Architecture, Application, Risk, and Service Management teams, the role translates security, compliance, and business requirements into robust identity controls, technical standards, and sustainable operating practices. The IAM Level 3 Engineer is accountable for improving identity-service resilience, strengthening authentication and access governance capabilities, and driving automation, standardisation, and operational excellence across the IAM landscape.

The position acts as a technical mentor and escalation point for IAM engineering teams, providing guidance on complex technical issues, platform optimisation opportunities, identity architecture decisions, and security best practices. In addition, the role provides technical assurance for major transformation initiatives, application integrations, compliance programmes, control implementations, and critical service events, ensuring solutions meet security, governance, and operational requirements.

Success in the role is measured through improvements in identity security posture, access governance maturity, automation adoption, service reliability, operational efficiency, audit readiness, and the overall effectiveness of enterprise IAM capabilities rather than through routine operational administration or ticket-based support activities.

Responsibilities

Identity Engineering, Security & Service Maturity

Serve as the principal technical authority for enterprise identity services, providing expert guidance on complex authentication, authorisation, directory, federation, hybrid identity, and certificate management capabilities across on-premises and cloud environments.
Lead the design, implementation, and optimisation of identity platform capabilities, including Active Directory, Microsoft Entra ID, Conditional Access, MFA, privileged access controls, federation services, and certificate management frameworks.
Drive the elimination of systemic identity-service risks through structured root-cause analysis, technical debt remediation, control enhancement initiatives, and the implementation of sustainable engineering solutions.
Strengthen identity security posture through the continual improvement of directory security standards, privileged access governance models, role-based access frameworks, service-account controls, and least-privilege operating principles in partnership with Cyber Security stakeholders.
Define and maintain enterprise identity integration standards, patterns, and reference architectures for application onboarding, federation services, single sign-on capabilities, application registrations, and modern authentication frameworks.
Provide technical stewardship for enterprise PKI and certificate-management services, enhancing lifecycle governance, automation, resilience, and operational assurance while reducing business risk associated with certificate dependencies.

Governance, Risk & Continuous Improvement

Evaluate identity-service architecture, platform health, control effectiveness, configuration maturity, and operational risks, developing prioritised improvement roadmaps that enhance security, compliance, and operational resilience.
Drive automation and engineering efficiency initiatives through the development of reusable tooling, orchestration capabilities, identity governance workflows, monitoring enhancements, and control-validation mechanisms.
Provide technical leadership during high-impact service events by directing diagnostic activities, validating recovery strategies, assuring service restoration outcomes, and translating lessons learned into long-term service improvements.

Engineering Standards & Capability Development

Establish and maintain engineering standards, operational frameworks, technical patterns, recovery strategies, and service acceptance criteria that improve consistency, scalability, and supportability across IAM services.
Act as a technical mentor and subject matter expert for IAM engineering teams, strengthening capability development, engineering quality, technical governance, and knowledge transfer across the function.
Provide technical assurance and advisory support for audits, compliance programmes, regulatory reviews, and security assessments, ensuring identity controls are demonstrable, effective, and aligned with organisational requirements.

Strategic Planning & Service Evolution

Leverage service intelligence, access governance analytics, operational trends, and risk insights to identify opportunities for service optimisation, security enhancement, automation, and platform modernisation.
Translate complex technical findings into actionable recommendations, risk-based decisions, and strategic improvement initiatives that support the IAM Service Owner in shaping the future direction of enterprise identity services.

Education

Bachelor's degree in Information Technology, Computer Science, Cybersecurity, Engineering, or equivalent professional experience.

Skills

Experience

7-11 years in IAM, Directory Services, Identity Security or Infrastructure engineering, including substantial third-line engineering and escalation ownership.

Knowledge, Skills & Ability

Deep technical knowledge of AD architecture, domain controllers, trusts, replication, DNS dependencies, OUs, GPOs and secure administrative models.
Advanced Microsoft Entra ID engineering across Conditional Access, MFA, Identity Protection, privileged roles, enterprise applications, app registrations and federation.
Strong hybrid identity expertise, including Entra Connect or cloud sync, authentication methods, synchronisation troubleshooting and resilience considerations.
Strong understanding of Kerberos, NTLM, OAuth 2.0, SAML 2.0 and OpenID Connect, with the ability to diagnose complex end-to-end authentication failures.
Practical PKI and certificate-services expertise covering certificate authorities, templates, issuance, renewal, revocation, certificate-based authentication and automation.
Ability to translate zero trust, least privilege, RBAC, privileged access and segregation-of-duties principles into implementable technical controls.
Advanced log analysis and investigation using identity, directory, cloud and security telemetry.
Strong PowerShell automation, peer review, version-control awareness and safe deployment practices.
Ability to create technical designs, standards, risk assessments, implementation plans and operational acceptance documentation.
Technical leadership, mentoring, stakeholder management and clear communication during incidents, changes, audits and design reviews.

Essential Requirements*

Demonstrable third-line IAM, directory-services or identity-security engineering experience in a complex enterprise environment.
Advanced hands-on experience with Active Directory, Microsoft Entra ID, hybrid identity and privileged access controls.
Proven ability to resolve complex authentication, synchronisation, policy, federation and certificate incidents and lead root-cause remediation.
Experience designing or engineering SSO, MFA, Conditional Access, enterprise application and standards-based authentication solutions.
Experience with certificate services or PKI operations, including renewal, revocation, monitoring and outage prevention.
Strong PowerShell automation capability and disciplined implementation through change, testing, documentation and rollback controls.
Ability to lead technical escalations, mentor engineers and communicate technical risk and recommendations to service leadership and Security.
Willingness to support UK-aligned 18/5 service coverage and participate in major incident support when required.

Required / Strongly Preferred

ITIL 4 Foundation
Microsoft SC-300 Identity and Access Administrator
Microsoft AZ-800/801 Windows Server Hybrid Administrator

Desirable

Microsoft SC-100 Cybersecurity Architect
Microsoft AZ-104
Security+ or ISO 27001 Foundation
PKI-specific training or certification