• Architect and implement access governance in Microsoft Entra ID using PIM, Conditional Access, Entitlement Management, and Azure RBAC with proper group lifecycle practices. • Design secure integration patterns for applications that still rely on classic AD groups, including hybrid group strategies, group writeback, and migration planning. • Own the full identity lifecycle, including provisioning, de-provisioning, access reviews, and governance workflows. • Lead modernization work to replace legacy AD group usage with Entra ID native controls and enforce least privilege across Azure and on-prem environments. • Define, implement, and automate group management policies such as naming standards, ownership rules, expiration, and dynamic membership. • Integrate Entra ID with SaaS platforms using SCIM or custom provisioning patterns. • Act as a Level 3 escalation point for complex identity incidents and operational challenges. • Mentor junior engineers and promote secure identity practices across teams. • Produce documentation including architecture decisions, runbooks, and governance standards.