Identity Security Consultant

Nair Systems is currently looking Identity Security Consultant our Qatar operations.

· 8+ years in Identity Security / Security Engineering

· Deep hands‑on experience with:

· Active Directory security

· Microsoft Entra ID security

· Strong PAM / PIM implementation experience

· SOC‑level understanding of identity attack detection and response

· Strong troubleshooting and root‑cause analysis skills

· Excellent written and verbal communication skills

· Own identity security engineering across Active Directory (on‑prem) and Microsoft Entra ID

· Design, implement, and harden identity security configurations

· Act as technical authority for identity threat prevention, detection, and response

· Bridge Identity Engineering and SOC / Incident Response

· Mitigate Red team findings

· Secure AD DS architecture and configurations

· Implement and enforce AD Tiering model (Tier 0 / Tier 1 / Tier 2)

· Protect Tier‑0 assets (Domain Controllers, PKI, ADFS, Entra Connect)

· Harden:

· Kerberos authentication

· NTLM usage and restrictions

· Delegation (constrained, resource‑based)

· GPOs for security baselines

· Manage privileged groups and admin separation

· Secure trust relationships and forest/domain boundaries

· Implement PAW / SAW / hardened admin access patterns

· Review and remediate AD attack paths and misconfigurations

· Design and enforce Conditional Access policies

· Implement strong authentication strategies (MFA, passwordless, phishing‑resistant MFA)

· Configure and monitor Entra ID Identity Protection

· Harden tenant security posture and reduce identity attack surface

· Control and monitor:

· Legacy authentication

· OAuth app permissions and consent

· Authentication methods and user flows

· Govern roles, service principals, and app registrations

· Secure Entra ID Connect / Cloud Sync architecture

· Design and implement least‑privilege access models

· Understand and work with Cyberark integrations, Sailpoint etc.

· Implement and operationalize Entra PIM:

· Just‑In‑Time role activation

· Approval workflows

· Role eligibility governance

· Access reviews and alerts