Senior Entra Identity Governance Engineer

Duration: 13+ Months

Location: MA-Waltham, 100% Remote

Overview: Every Turnberry consultant belongs to a practice, an internal group of consultants and leaders with shared experience and expertise. Each of these practices aligns to one of the core services Turnberry offers to clients. As a Senior Entra Identity Governance Engineer, you will join Turnberry's Digital Modernization practice, where technology and strategy combine to deliver exceptional digital experiences, empowering organizations to thrive in today's digital market.

• Business Partnership, Requirements Discovery, and Access Modeling
  • Partner directly with IT service teams, application owners, business process owners, and cybersecurity stakeholders to understand service delivery models, user populations, operational workflows, and access requirements
  • Lead discovery workshops and stakeholder interviews to document business roles, access personas, entitlement dependencies, approval authorities, ownership, and joiner/mover/leaver scenarios
  • Translate business requirements into scalable Entitlement Management catalogs, Access Packages, resource groupings, assignment policies, and approval and expiration controls
  • Assess existing access models and identify opportunities to replace manual group assignments and ticket-based provisioning with governed self-service access
  • Define and validate access matrices, catalog ownership, requestor eligibility, approval routing, review cadence, separation-of-duties constraints, and exception handling with service owners
  • Coordinate user acceptance testing, rollout communications, service desk readiness, and operational handoff; maintain ongoing relationships to evolve catalogs and packages as business needs change
  • Collaborate with AI platform and application teams to discover agent use cases, sponsors, non-human identities, permissions, and governance workflows, and translate these into governed onboarding and lifecycle controls
• Entitlement Management and Access Packages
  • Design and administer catalogs, access packages, resource roles, assignment policies, and delegated catalog ownership
  • Configure request eligibility, multi-stage approvals, sponsor/manager approval, assignment expiration, extensions, and automated removal
  • Govern access to security groups, Microsoft 365 groups, Teams, SharePoint Online sites, and enterprise applications
  • Implement B2B guest access, connected organizations, contractor access, and external collaboration governance
  • Migrate manually provisioned access to governed, self-service access packages with minimal business disruption
• Identity Lifecycle and Access Reviews
  • Implement joiner, mover, and leaver controls using Entra Lifecycle Workflows and integrations with HR and ITSM systems
  • Design recurring access reviews for applications, groups, guests, and privileged access, with documented ownership and remediation
  • Automate provisioning, deprovisioning, access expiration, certification evidence, and exception handling
  • Align review frequency and evidence with internal policy and applicable SOX/GxP requirements
• AI Agent and Non-Human Identity Governance
  • Design governance processes for Microsoft 365 agents, Copilot Studio agents, autonomous agents, and associated agent user identities
  • Create agent intake, registration, ownership, business sponsorship, risk classification, approval, and periodic recertification workflows
  • Integrate Service Now approvals and Microsoft Entra controls to enforce approved versus unapproved agent access, where technically supported
  • Use Microsoft Entra custom security attributes, Conditional Access for supported agent identities, and automation to support policy enforcement and lifecycle controls
  • Develop controls for agent onboarding, credential and permission…