Arden Hills Principal Engineer, Identity & Access Management (IAM) Microsoft Entra ID MN 55112

Job description

Additional Location(s): US-MN-Arden Hills; US-MA-Marlborough Diversity - Innovation - Caring - Global Collaboration - Winning Spirit - High Performance At Boston Scientific, we’ll give you the opportunity to harness all that’s within you by working in teams of diverse and high-performing employees, tackling some of the most important health industry challenges. With access to the latest tools, information and training, we’ll help you in advancing your skills and career. Here, you’ll be supported in progressing – whatever your ambitions. About the role: Boston Scientific was recognized by Forbes as one of the Best Workplaces for Engineers in 2026, reflecting a culture where engineers do meaningful work. Boston Scientific was recognized as a Glassdoor Best Place to Work in 2026, ranking No. 15 on the Top 100 list, reflecting the culture our employees experience every day. Boston Scientific is seeking a Principal Engineer, Identity & Access Management (IAM), specializing in Microsoft Entra ID and cloud identity to provide enterprise-level technical leadership in the architecture, security, engineering and modernization of our global identity services.As a principal-level individual contributor, you will establish technical direction, architectural standards and engineering best practices for cloud identity services supporting corporate IT, cloud platforms, manufacturing operations and operational technology (OT) environments. You will also enable secure identity integration with customer-facing applications and Digital Health solutions. This hands-on technical leadership role requires deep expertise in Microsoft Entra ID, modern authentication, identity security and cloud architecture. You will lead complex engineering initiatives, resolve critical identity challenges and influence enterprise technology decisions while advancing platform security, resilience and operational excellence.You will collaborate with cybersecurity, infrastructure, cloud, enterprise architecture, Digital Health, application development, manufacturing and customer identity teams to deliver secure, scalable and reliable identity solutions that support Boston Scientific's mission of transforming lives through innovative medical solutions. Work model, sponsorship, relocation: This position may be based in Arden Hills, Minnesota, or Marlborough, Massachusetts. At Boston Scientific, we value collaboration and synergy. This role follows a hybrid work model requiring employees to be in our local office at least three days per week. Boston Scientific will not offer sponsorship or take over sponsorship of an employment visa for this position at this time. Relocation assistance is not available for this position at this time. Your responsibilities will include: Define and drive the enterprise architecture, technical strategy and engineering roadmap for Microsoft Entra ID and cloud identity services across a complex global environment. Serve as a principal technical authority for Microsoft Entra ID, authentication, authorization, federation and cloud identity architecture, providing guidance on complex technical decisions and enterprise integration patterns. Architect and advance enterprise identity security controls, including Conditional Access, multifactor authentication (MFA), passwordless authentication, Identity Protection, Privileged Identity Management (PIM) and Zero Trust principles. Establish secure administrative and privileged identity models aligned with least privilege, identity tiering, privileged access protection and enterprise cybersecurity standards. Define architectural standards and secure integration patterns between Microsoft Entra ID and on-premises Active Directory, partnering with directory engineering teams to manage hybrid identity dependencies and security boundaries. Lead the design of secure identity and authentication solutions supporting corporate IT, cloud platforms and manufacturing/OT environments, balancing cybersecurity requirements with operational resilience, availability and business continuity. Establish enterprise integration standards for single sign-on (SSO), SAML, OAuth 2.0, OpenID Connect, application registrations, API permissions, service principals, managed identities and workload identities. Partner with Digital Health, customer identity and access management (CIAM), and application teams to define secure authentication and authorization architectures for customer-facing applications, partner access and external identity solutions. Define secure integration patterns across Microsoft Entra ID, Saviynt, CyberArk and the broader enterprise IAM ecosystem. Establish architectural and engineering standards for Azure role-based access control (RBAC), external identities, business-to-business (B2B) collaboration, cross-tenant access, privileged cloud identities and emergency access. Drive engineering automation and infrastructure modernization using Microsoft Graph, PowerShell, REST APIs, Terraform and infrastructure as code (IaC) technologies. Define enterprise identity logging, monitoring, auditing and telemetry requirements, partnering with Security Operations to integrate identity security signals into security information and event management (SIEM) platforms, including Splunk. Lead complex technical design reviews, root-cause investigations, identity resilience and recovery initiatives, and strategic platform modernization efforts. Serve as a senior technical escalation point for complex identity, authentication, federation, authorization and cloud security challenges, driving sustainable enterprise solutions. Establish and govern engineering standards, architectural documentation, operating procedures, configuration baselines, technical runbooks and troubleshooting practices to ensure consistent service delivery. Identify systemic platform risks, technical debt and opportunities for automation, continuous improvement and operational efficiency. Influence cross-functional architectural decisions, communicate technical risks and trade-offs, and align engineering solutions with enterprise cybersecurity and business objectives. Mentor IAM engineers through architectural guidance, technical design reviews, knowledge sharing and hands-on coaching, fostering engineering excellence and continuous improvement. Required qualifications: Minimum Bachelor's degree in computer science, information technology, engineering, cybersecurity or a related field. Minimum of 7 years' experience in identity and access management, cloud identity engineering, cybersecurity architecture or a related technical discipline. Hands-on experience designing, engineering and securing Microsoft Entra ID environments within complex, large-scale enterprises. Advanced expertise in Microsoft Entra ID, Conditional Access, MFA, passwordless authentication, enterprise applications, PIM and cloud identity architecture. Strong knowledge of modern authentication and authorization technologies, including SAML, OAuth 2.0, OpenID Connect, Microsoft Graph, Azure RBAC, service principals, managed identities and workload identities. Demonstrated experience designing and securing enterprise application integrations, external identity solutions, cross-tenant access and cloud identity services. Experience automating identity infrastructure and engineering processes using PowerShell, Microsoft Graph APIs, REST APIs, Terraform or comparable technologies. Deep understanding of Zero Trust architecture, least privilege, privileged identity security, identity tiering and modern authentication security principles. Experience establishing identity logging, monitoring, auditing and operational security controls for enterprise identity platforms. Demonstrated ability to define technical architecture, establish engineering standards and lead complex, cross-functional initiatives across multiple technology organizations. Advanced troubleshooting and problem-solving skills across identity, authentication,