Job Description
Hi
\n
Role: Senior Identity & Conditional Access Security Architect/SME
\n
Location: Chicago, IL – Onsite
\n
Rate: $70/hr to $75/hr on C2C All Inclusive
\n
Duration: 6 Months
\n
Contract Role
\n
\n
Job description:
\n
Role Summary
\n
We are seeking a Senior Identity & Conditional Access Security Architect to lead the design, architecture, and governance of enterprise identity security and Microsoft Entra Conditional Access capabilities.
\n
The ideal candidate must be capable of independently assessing the current identity environment, designing a comprehensive Conditional Access Policy framework, documenting the architecture and security rationale, evaluating business and operational impact, and presenting the proposed strategy directly to the CISO and senior security leadership for review and approval.
\n
This person will serve as the technical authority for Microsoft Entra ID, Conditional Access, Zero Trust Identity, MFA, PIM, Identity Protection, privileged access, and identity governance.
\n
The profile should combine deep hands-on technical expertise with strong architecture documentation and executive-level communication skills.
\n
\n
Key Responsibilities
\n
Conditional Access Architecture and Policy Design
\n
- \n
- Own the end-to-end architecture and design of Microsoft Entra Conditional Access policies.
- Assess existing Conditional Access policies and identify gaps, overlaps, conflicting controls, exclusions, security risks, and opportunities for consolidation.
- Design Conditional Access policies based on:
- User/group identity
- Administrative and privileged roles
- Applications and cloud resources
- Device compliance
- Device platforms
- Network/location conditions
- Authentication strength
- Sign-in risk
- User risk
- Workload identities where applicable
- Design policies addressing scenarios such as:
- Require MFA
- Phishing-resistant MFA
- Block legacy authentication
- Require compliant or managed devices
- High-risk sign-in/user controls
- Administrative portal protection
- Guest/B2B access
- Service and emergency access scenarios
- Geographic/location restrictions
- Session controls
- BYOD access
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
Conditional Access Strategy & CISO Presentation
\n
- \n
- Develop an enterprise Conditional Access strategy and policy architecture aligned with Zero Trust principles.
- Create clear current-state and future-state architecture diagrams.
- Produce an executive-level Conditional Access proposal explaining:
- Current security gaps
- Proposed policies
- Threat/risk addressed by each policy
- Business impact
- User experience impact
- Exception strategy
- Rollout approach
- Testing methodology
- Rollback procedures
- Risk reduction and expected security outcomes
- Present the Conditional Access design and recommendations directly to the CISO, security leadership, IAM leadership, architecture review boards, and other senior stakeholders.
- Translate highly technical identity-security concepts into clear business-risk language suitable for executive decision making.
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
Microsoft Entra ID & Zero Trust
\n
- \n
- Architect and strengthen Microsoft Entra ID identity-security capabilities.
- Design and implement MFA, authentication strengths, PIM, Identity Protection, RBAC, JIT access, B2B access, and Identity Governance.
- Apply Zero Trust principles across workforce, privileged, guest, and application access.
- Define least-privilege and privileged-access strategies.
- Partner with SOC and security teams to incorporate identity risk and suspicious sign-in signals into security operations.
- Demonstrates experience with Microsoft Entra/Azure AD, B2B/B2C, RBAC, PIM, Conditional Access, MFA, JIT, Identity Protection and Zero Trust policy design, making these appropriate core requirements for the role.
\n
\n
\n
\n
\n
\n
\n
\n
Conditional Access Deployment & Governance
\n
- \n
- Establish a structured lifecycle for policy design → review → Report-only mode → pilot → validation → production rollout → monitoring → optimization.
- Define policy naming conventions, documentation standards, ownership, exception management, and change-control processes.
- Establish dedicated break-glass/emergency access account architecture and monitoring.
- Analyze sign-in logs and Conditional Access results before enforcement.
- Ensure policies do not inadvertently disrupt administrators, service identities, business-critical applications, or approved access scenarios.
- Define periodic policy review and recertification processes.
\n
\n
\n
\n
\n
\n
\n
\n
Security Architecture & Compliance
\n
- \n
- Align identity controls with relevant enterprise security frameworks including NIST, CIS, ISO 27001, SOC 2, PCI DSS and Zero Trust principles.
- Maintain architecture diagrams, security standards, implementation guides, policy matrices, decision records, and security-control documentation.
- Partner with Cloud Security, SOC, IAM, Endpoint, Infrastructure, Network, GRC, Application Security and business teams.
\n
\n
\n
\n
The reference profile also demonstrates architecture/governance work against NIST, ISO 27001, CIS, SOC 2, PCI DSS, SOX, HIPAA and GDPR, with experience creating architecture documentation and governance frameworks.
\n
\n
Required Skills
\n
Area
\n
Requirement
\n
Microsoft Entra ID
\n
Expert
\n
Conditional Access
\n
Expert, hands-on policy design required
\n
Zero Trust Identity
\n
Expert
\n
MFA / Authentication Strength
\n
Advanced
\n
Microsoft Entra ID Protection
\n
Advanced
\n
PIM / Privileged Identity
\n
Advanced
\n
Identity Governance
\n
Advanced
\n
RBAC / Least Privilege
\n
Advanced
\n
Device-based Access
\n
Strong
\n
Microsoft Intune
\n
Strong understanding
\n
B2B / Guest Access
\n
Strong
\n
Security Architecture
\n
Expert
\n
NIST / CIS / ISO 27001
\n
Strong
\n
Architecture Documentation
\n
Expert
\n
Executive Presentations
\n
Must be CISO-ready
\n
\n
Must-Have Experience
\n
- \n
- 8+ years of IT/security experience with significant Identity and Access Management or security architecture responsibility.
- Strong hands-on experience designing Microsoft Entra Conditional Access policies in large enterprise environments.
- Demonstrated ability to build a Conditional Access framework from requirements through production deployment.
- Experience with Microsoft Entra ID, MFA, PIM, Identity Protection, RBAC and Zero Trust.
- Experience assessing existing policies and designing target-state identity architectures.
- Ability to produce architecture-level documentation and security-design artifacts.
- Demonstrated experience communicating security architecture to CISO/security executives.
- Strong understanding of the balance between security controls, business continuity and end-user experience.
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
Expected Deliverables
\n
Within the engagement, the architect should be capable of producing:
\n
- \n
- Current-state Conditional Access assessment
- Identity/security gap analysis
- Conditional Access policy matrix
- Target-state architecture
- Zero Trust identity roadmap
- Policy dependency and exclusion analysis
- Break-glass/emergency access design
- Report-only and pilot strategy
- Production rollout and rollback plan
- Exception/governance process
- Security-risk and business-impact assessment
- Executive/CISO presentation deck with recommendations and decision points
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n