SailPoint Consultant (ISC)

Overview:

The organization is seeking a qualified contractor to provide hybrid operational support, system integration engineering, and automated workflow optimization. This role will support and improve the identity and messaging ecosystem across the following core platforms:

• SailPoint Identity Security Cloud (ISC) and NERM
• Active Directory (AD) On-Premises
• Azure Active Directory (Azure AD / Microsoft Entra ID)
• Microsoft Exchange Online / Exchange Server Hybrid Messaging 

Scope of Work:

The contractor will focus on complex implementation work, onboarding new platform modules, improving integration workflows, and performing root-cause analysis of systemic issues across identity, directory, and messaging systems. The role is intended to support long-term stabilization and automation rather than high-volume transactional ticket closure.

Key Responsibilities:

1. On-Premises Active Directory (AD) Operational Tasks

• Health & Directory Maintenance: Monitor, troubleshoot, and remediate health issues within the on-premises AD environment related to object corruption, duplication, or sync latencies affecting downstream IAM tools.
• Organizational Unit (OU) & Object Management: Restructure, cleanup, and standardize OU architecture, managed service accounts (MSAs), and security groups to facilitate accurate automated provisioning.
• Group Policy Object (GPO) Alignment: Review and adjust GPOs impacting user provisioning, login scripts, and local profile creation to eliminate conflicts with SailPoint-driven access models.
• Nested Group Rationalization: Audit and remediate highly nested security groups causing token bloat or unmapped access privileges during automated SailPoint entitlement aggregations.
• Sid-History and Schema Attribute Audits: Remediate legacy security identifier (SID) histories and validate schema extensions required for advanced attribute matching across hybrid infrastructures.

1. Azure AD Direct Connector Deployment to SailPoint ISC

• Architect, configure, and deploy the native SailPoint Azure AD direct connector to replace or augment legacy synchronization pathways.
• Configure secure OAuth 2.0 API integrations via Microsoft Graph API.
• Establish data aggregation schedules, attribute mappings, and account correlation rules to ensure zero downtime.

1. SailPoint ISC

• Integrate an inbound data feed driven directly by a ServiceNow Request payload into SailPoint NERM to automate Contractor onboarding.

• Automate non-employee identity creation, sponsor tracking, lifecycle transitions, and downstream birthright access provisioning.

• Support automated onboarding and offboarding processes.

• Implement workflow enhancements for employee status changes.

• Monitor and manage the entire SailPoint ISC environment including integrations with Workday, Active Directory, Azure AD, and SailPoint.

• Create and update approval workflows and policies.

• Review and resolve identity lifecycle processing errors.

• Monitor account aggregation jobs and connector health.

• Troubleshoot provisioning and deprovisioning failures.

1. Microsoft Exchange Online / Hybrid Messaging Operational Tasks

• Mailbox Lifecycle Management: Administer mailbox provisioning, modification, deactivation, shared mailbox conversion, mailbox delegation, and retention-related transitions aligned with identity lifecycle events.

• Distribution Group and Mail-Enabled Security Group Governance: Standardize ownership, membership review, naming conventions, and request fulfillment for Microsoft Exchange distribution groups and mail-enabled security groups.

• Hybrid Exchange Attribute Alignment: Validate mail attributes, proxy addresses, aliases, target addresses, remote mailbox properties, and directory synchronization dependencies between on-premises AD, Exchange, and Microsoft Entra ID.

• Mail Flow and Transport Rule Support: Troubleshoot delivery issues, connector behavior, allowed/blocked sender configuration, transport exceptions, and rule conflicts that affect business operations.

• Exchange Automation and ServiceNow Integration: Build or refine PowerShell-based automation and ServiceNow fulfillment processes for mailbox, group, delegation, and lifecycle requests with appropriate auditability and error handling.

• Compliance and Retention Coordination: Support mailbox hold, retention, archive, eDiscovery support, and access review processes in coordination with security, records, and compliance stakeholders.

Qualifications:

• Experience with SailPoint (or any other Identity Governance and Administration solution) and Microsoft Entra.
• Experience managing Joiner-Mover-Leaver (JML) processes.
• Experience troubleshooting provisioning and aggregation failures.
• Strong understanding of identity lifecycle management and security frameworks.
• Familiarity with hybrid Exchange environments and Office 365 services.
• Deep operational expertise with Microsoft Active Directory Services (Forest/Domain architecture, GPO application, trust relationships) and Azure AD/Microsoft Entra ID schemas.
• Hands-on experience administering Microsoft Exchange Online and hybrid Exchange environments, including mailbox management, distribution groups, mail flow, transport rules, delegation, retention, archive, and PowerShell automation.
• Proven implementation history with SailPoint Identity Security Cloud (ISC) and NERM.
• Strong capabilities in scripting languages (PowerShell, JavaScript, or BeanShell) used for building custom enterprise integration paths.
• Prior work with public sector, regulated, or large-scale enterprise IT operations is preferred.
• Vendor certification in AD, AAD, SailPoint, Exchange is highly preferred.