Lead Infrastructure Engineer (Identity)

As Lead Infrastructure Engineer (Identity), you will take a leading technical role in transforming the University's identity and access services, helping us move from traditional on-premises Active Directory and synchronisation-based identity towards a modern, cloud-native Microsoft Entra-first architecture.

You will help define and deliver our identity roadmap, developing secure and resilient services built around Zero Trust, passwordless authentication, identity governance and automated identity lifecycle management. Working with HR, Information Security, application owners and Service Delivery, you will help modernise how identities are created, managed, governed and secured across the University.

The role has a strong focus on Microsoft Entra ID and Entra ID Governance, Conditional Access, Privileged Identity Management, Microsoft Graph and automation, alongside the Azure and hybrid infrastructure that supports these services. You will also help develop API-based integration with authoritative HR and student identity sources, reducing manual processes and our dependency on legacy identity infrastructure.

This is a 2-year fixed-term transformation opportunity with the chance to make a significant and lasting impact on the University's technology landscape. You will lead and support key projects that improve security, simplify the experience for students and staff, increase automation and establish the identity foundations needed to support the University's future digital services.

Principal Accountabilities – Identity and Cloud Infrastructure:

- Provide service ownership and technical leadership for assigned identity and cloud infrastructure services, developing strategies, roadmaps and designs, implementing service improvements, maintaining documentation and ensuring effective service transition across internal teams.
- Develop and execute a 2-year strategic roadmap to transition from on-premises Active Directory reliance and Entra Connect sync mechanics toward an Entra-first, cloud-native identity and access management architecture.
- Undertake sector horizon scanning and benchmark identity and cloud services to ensure they remain secure, supportable and future focused.
- Produce and maintain architecture, design, configuration and operational documentation to support readiness, assurance, training, process development and the clear communication of technical standards.
- Define and promote technical standards for identity, authentication including the journey to passwordless and ZTNA, authorisation, cloud infrastructure, software and configuration management within the scope of the role.
- Ensure appropriate disaster recovery and business continuity arrangements are defined, documented and tested for assigned identity and infrastructure services.
- Identify existing processes for the development of either new or improved automation.
- Design and implement complex integrations and automation between authoritative identity data sources, Active Directory, Microsoft Entra ID, Microsoft 365 and other University services.
- Work closely with other teams across the business to improve efficiency and adapt existing processes to enable a secure, smooth, and successful migration to a modern hybrid cloud infrastructure.
- Lead key projects that may span the department and wider University, including identity modernisation and cloud infrastructure initiatives.
- Implement and mature Microsoft Entra ID Governance features, including Access Reviews, Entitlement Management, Lifecycle Workflows, and Privileged Identity Management (PIM).
- Ensure monitoring of all services, including predictive analytics and Entra identity protection telemetry, is available for all services.

Information Security:

- Maintain security of complex hybrid and cloud-native systems through implementing secure strategies such as Conditional Access, Zero Trust access principles, and Entra Private Access, policies and controls, automating where possible.

Incident Management:

- Lead or mentor others in the prioritisation and diagnosis of identity, access, cloud and infrastructure incidents in accordance with agreed procedures. Investigate causes, coordinate resolution and recovery, escalate where required, document outcomes and ensure lessons learned are applied.

Problem Management:

- Initiate and monitor actions to investigate and resolve problems in systems, processes, and services. Determine problem fixes/remedies. Assist with the implementation of agreed remedies and preventative measures.
- Act as a third-line escalation point for highly complex identity, access, cloud and infrastructure issues and lead root cause analysis for assigned services.

Change Management:

- Evaluate the impact of proposed or required changes (internally and by vendors) especially in the areas of hardware, software, performance, maintenance, and cost; provide recommendations to management with an impact assessment.

Relationships:

- Work with team manager on managing external vendors and suppliers ensuring vendors are delivering on service and providing best value to the University.
- Work in a multidisciplinary team environment to deliver complex identity and cloud infrastructure solutions for multiple internal and external stakeholders.
- Provide technical leadership, coaching and mentoring across Cloud Infrastructure and Service Delivery, particularly in identity, access management and automation practices.

Essential Criteria:

Qualifications:
- BSc in Computer Science or a related discipline, or equivalent substantial professional experience in an identity, cloud or infrastructure engineering role.

Experience:
- Significant experience of implementing innovative solutions that are customer and future focused, particularly using Azure Cloud technologies and Microsoft Entra Suite.
- Significant experience administering and engineering Microsoft Entra ID and Active Directory, including hybrid identity, directory synchronisation, enterprise applications, single sign-on, role-based access control, Conditional Access and privileged identity controls.
- Strong background in designing and delivering enterprise identity and hybrid cloud solutions, including identity architecture, directory services, automation, Azure DevOps and infrastructure-as-code or configuration-management approaches such as Terraform and Ansible.
- Experience of automating identity lifecycle and infrastructure services using PowerShell, Microsoft Graph API, workflows and infrastructure-as-code or configuration-management practices.
- Proven experience delivering in a high-performance multi-disciplinary infrastructure team.
- Demonstrated experience in modernising identity environments, including reducing on-premises Active Directory dependency and transitioning synchronization models towards Entra-first native cloud identities.
- Demonstrated proficiency with relevant programming/scripting and source code management.
- Demonstrated proficiency with command line and interactive shells.
- Proficient in using source control and Azure DevOps or equivalent CI/CD tooling to manage, test and deploy identity and infrastructure configuration safely and consistently.
- Experience designing, deploying and managing secure, resilient and scalable solutions across Azure and hybrid Microsoft environments.
- Experience integrating identity and access controls with applications, cloud services and supporting infrastructure technologies.
- Demonstrated proficiency in Microsoft Entra ID, Azure, Microsoft 365 and hybrid identity services, including directory synchronisation, enterprise applications, access controls, conditional access and authentication methods.

Skills, Knowledge & Abilities:
- Strong configuration, secrets and change-management practices for identity and infrastructure services.
- Knowledge of application delivery and network services, for example, DNS, DHCP and IP address management.
- Understanding of project management lifecycle from conception through implementation.
- In-depth technical knowledge of Microsoft Entra ID and Governance, Active Directory, authentication and authorisation, identity lifecycle management, Windows Server and related application infrastructure technologies.

Business Requirements:
- Work as part of an on-call out-of-hours rota.

Desirable Criteria:

Qualifications:
- Relevant industry technical certification, for example Microsoft Certified: Identity and Access Administrator Associate, Cybersecurity Architect Expert or Azure Administrator Associate.
- ITIL Foundation.

Experience:
- Experience of configuration-management and development lifecycles; familiarity with DevOps practices and automation using Ansible, Azure DevOps or equivalent tooling.
- Integration of cloud services with on-premises infrastructure.
- Proven experience of developing technical strategies and policies in line with business requirements.
- Previous experience within a Higher Education Institution.
- Experience of managing support contracts, ensuring vendors are compliant with their SLAs.
- Experience supporting core infrastructure platforms such as Hyper-V or Azure Stack HCI.

Skills, Knowledge & Abilities (Desirable):
- Understanding of information security best practice as it applies to identity, authentication, privileged access, audit, logging and hybrid cloud infrastructure.
- Understanding of configuration management tools and techniques as part of application and infrastructure.
- Knowledge of container technologies such as Docker, Kubernetes or OpenShift and their identity and access integration requirements.
- Strong orchestration, scripting and automation experience using technologies such as PowerShell, Microsoft Graph, APIs, Azure DevOps, Ansible or Terraform.
- Knowledge of Windows Server and Red Hat Operating Systems.
- Understanding of procurement regulations, guidelines, and procedures such as tender processes and IT public sector frameworks.

Benefits:
- Generous annual leave entitlement of 38 days inclusive of bank holidays and concessionary days (pro rata)
- Local Government Pension Scheme
- Suite of holistic wellbeing benefits and support including family-friendly policies, generous sick pay provision and comprehensive Employee Assistance Programme
- Access to a variety of staff discounts at high street retailers
- Discounted onsite gym
- Holiday purchase
- Cycle to Work scheme
- A flexible working environment
- A commitment to personal and professional development