Principal Engineer, Identity & Access Management (IAM) - Microsoft Entra ID

Additional Location(s): US-MN-Arden Hills; US-MA-Marlborough

Diversity - Innovation - Caring - Global Collaboration - Winning Spirit - High Performance

At Boston Scientific, we’ll give you the opportunity to harness all that’s within you by working in teams of diverse and high-performing employees, tackling some of the most important health industry challenges. With access to the latest tools, information and training, we’ll help you in advancing your skills and career. Here, you’ll be supported in progressing – whatever your ambitions.

About the role:

Boston Scientific was recognized by Forbes as one of the Best Workplaces for Engineers in 2026, reflecting a culture where engineers do meaningful work.

Boston Scientific was recognized as a Glassdoor Best Place to Work in 2026, ranking No. 15 on the Top 100 list, reflecting the culture our employees experience every day.

Boston Scientific is seeking a Principal Engineer, Identity & Access Management (IAM), specializing in Microsoft Entra ID and cloud identity to provide enterprise-level technical leadership in the architecture, security, engineering and modernization of our global identity services.As a principal-level individual contributor, you will establish technical direction, architectural standards and engineering best practices for cloud identity services supporting corporate IT, cloud platforms, manufacturing operations and operational technology (OT) environments. You will also enable secure identity integration with customer-facing applications and Digital Health solutions. This hands-on technical leadership role requires deep expertise in Microsoft Entra ID, modern authentication, identity security and cloud architecture. You will lead complex engineering initiatives, resolve critical identity challenges and influence enterprise technology decisions while advancing platform security, resilience and operational excellence.You will collaborate with cybersecurity, infrastructure, cloud, enterprise architecture, Digital Health, application development, manufacturing and customer identity teams to deliver secure, scalable and reliable identity solutions that support Boston Scientific's mission of transforming lives through innovative medical solutions.

Work model, sponsorship, relocation:

This position may be based in Arden Hills, Minnesota, or Marlborough, Massachusetts.

At Boston Scientific, we value collaboration and synergy. This role follows a hybrid work model requiring employees to be in our local office at least three days per week. Boston Scientific will not offer sponsorship or take over sponsorship of an employment visa for this position at this time. Relocation assistance is not available for this position at this time.

Your responsibilities will include:

• Define and drive the enterprise architecture, technical strategy and engineering roadmap for Microsoft Entra ID and cloud identity services across a complex global environment.

• Serve as a principal technical authority for Microsoft Entra ID, authentication, authorization, federation and cloud identity architecture, providing guidance on complex technical decisions and enterprise integration patterns.

• Architect and advance enterprise identity security controls, including Conditional Access, multifactor authentication (MFA), passwordless authentication, Identity Protection, Privileged Identity Management (PIM) and Zero Trust principles.

• Establish secure administrative and privileged identity models aligned with least privilege, identity tiering, privileged access protection and enterprise cybersecurity standards.

• Define architectural standards and secure integration patterns between Microsoft Entra ID and on-premises Active Directory, partnering with directory engineering teams to manage hybrid identity dependencies and security boundaries.

• Lead the design of secure identity and authentication solutions supporting corporate IT, cloud platforms and manufacturing/OT environments, balancing cybersecurity requirements with operational resilience, availability and business continuity.

• Establish enterprise integration standards for single sign-on (SSO), SAML, OAuth 2.0, OpenID Connect, application registrations, API permissions, service principals, managed identities and workload identities.

• Partner with Digital Health, customer identity and access management (CIAM), and application teams to define secure authentication and authorization architectures for customer-facing applications, partner access and external identity solutions.

• Define secure integration patterns across Microsoft Entra ID, Saviynt, CyberArk and the broader enterprise IAM ecosystem.

• Establish architectural and engineering standards for Azure role-based access control (RBAC), external identities, business-to-business (B2B) collaboration, cross-tenant access, privileged cloud identities and emergency access.

• Drive engineering automation and infrastructure modernization using Microsoft Graph, PowerShell, REST APIs, Terraform and infrastructure as code (IaC) technologies.

• Define enterprise identity logging, monitoring, auditing and telemetry requirements, partnering with Security Operations to integrate identity security signals into security information and event management (SIEM) platforms, including Splunk.

• Lead complex technical design reviews, root-cause investigations, identity resilience and recovery initiatives, and strategic platform modernization efforts.

• Serve as a senior technical escalation point for complex identity, authentication, federation, authorization and cloud security challenges, driving sustainable enterprise solutions.

• Establish and govern engineering standards, architectural documentation, operating procedures, configuration baselines, technical runbooks and troubleshooting practices to ensure consistent service delivery.

• Identify systemic platform risks, technical debt and opportunities for automation, continuous improvement and operational efficiency.

• Influence cross-functional architectural decisions, communicate technical risks and trade-offs, and align engineering solutions with enterprise cybersecurity and business objectives.

• Mentor IAM engineers through architectural guidance, technical design reviews, knowledge sharing and hands-on coaching, fostering engineering excellence and continuous improvement.

Required qualifications:

• Minimum Bachelor's degree in computer science, information technology, engineering, cybersecurity or a related field.

• Minimum of 7 years' experience in identity and access management, cloud identity engineering, cybersecurity architecture or a related technical discipline.

• Hands-on experience designing, engineering and securing Microsoft Entra ID environments within complex, large-scale enterprises.

• Advanced expertise in Microsoft Entra ID, Conditional Access, MFA, passwordless authentication, enterprise applications, PIM and cloud identity architecture.

• Strong knowledge of modern authentication and authorization technologies, including SAML, OAuth 2.0, OpenID Connect, Microsoft Graph, Azure RBAC, service principals, managed identities and workload identities.

• Demonstrated experience designing and securing enterprise application integrations, external identity solutions, cross-tenant access and cloud identity services.

• Experience automating identity infrastructure and engineering processes using PowerShell, Microsoft Graph APIs, REST APIs, Terraform or comparable technologies.

• Deep understanding of Zero Trust architecture, least privilege, privileged identity security, identity tiering and modern authentication security principles.

• Experience establishing identity logging, monitoring, auditing and operational security controls for enterprise identity platforms.

• Demonstrated ability to define technical architecture, establish engineering standards and lead complex, cross-functional initiatives across multiple technology organizations.

• Advanced troubleshooting and problem-solving skills across identity, authentication, federation, authorization and cloud environments.

• Ability to evaluate complex identity solutions from cybersecurity, operational resilience, scalability and business continuity perspectives.

• Strong communication and technical leadership skills, with the ability to influence architectural decisions, translate business requirements into engineering solutions and mentor engineers without direct reporting authority.

Preferred qualifications:

• Experience with on-premises Microsoft Active Directory and hybrid AD/Entra identity architectures, including synchronization, authentication dependencies, security boundaries and privileged identity considerations.

• Knowledge of Active Directory security, administrative tiering, Tier 0 protection and directory hardening.

• Experience delivering IAM or cybersecurity solutions within medical device manufacturing, healthcare, pharmaceutical, manufacturing or other highly regulated environments.

• Experience designing secure identity architectures supporting manufacturing systems and operational technology environments.

• Knowledge of IT/OT security architecture, network segmentation, legacy-system integration, high-availability manufacturing environments and hybrid identity dependencies.

• Experience integrating Microsoft Entra ID with CyberArk, Saviynt or comparable privileged access management and identity governance platforms.

• Experience with Splunk or comparable SIEM technologies supporting identity monitoring, auditing, security detection and investigation.

• Advanced experience with Microsoft Entra External ID, B2B collaboration, Entitlement Management, Identity Protection, workload identities and cross-tenant access.

• Experience supporting authentication and identity integration for customer-facing applications, Digital Health platforms, partner ecosystems or CIAM environments.

• Familiarity with complementary IAM and security technologies, including Yubico, DigiCert, 1Password, Ping Identity or CrowdStrike Falcon Identity.

• Knowledge of cybersecurity frameworks and industry standards, including the NIST Cybersecurity Framework, NIST SP 800-82, IEC 62443 and Zero Trust principles.

• Relevant Microsoft identity, cloud architecture or cybersecurity certifications.

Requisition ID: 637158

Minimum Salary: $102100

Maximum Salary: $194000

The anticipated compensation listed above and the value of core and optional employee benefits offered by Boston Scientific (BSC) – see www.bscbenefitsconnect.com—will vary based on actual location of the position and other pertinent factors considered in determining actual compensation for the role. Compensation will be commensurate with demonstrable level of experience and training, pertinent education including licensure and certifications, among other relevant business or organizational needs. At BSC, it is not typical for an individual to be hired near the bottom or top of the anticipated salary range listed above.

Compensation for non-exempt (hourly), non-sales roles may also include variable compensation from time to time (e.g., any overtime and shift differential) and annual bonus target (subject to plan eligibility and other requirements).

Compensation for exempt, non-sales roles may also include variable compensation, i.e., annual bonus target and long-term incentives (subject to plan eligibility and other requirements).

For MA positions: It is unlawful to require or administer a lie detector test for employment. Violators are subject to criminal penalties and civil liability.

Boston Scientific transforms lives through innovative medical technologies that improve the health of patients around the world. As a global medical technology leader for more than 45 years, we advance science for life by providing a broad range of high-performance solutions that address unmet patient needs and reduce the cost of healthcare. Our portfolio of devices and therapies helps physicians diagnose and treat complex cardiovascular, respiratory, digestive, oncological, neurological and urological diseases and conditions. Learn more at www.bostonscientific.com and follow us on LinkedIn.

Boston Scientific Corporation has been and will continue to be an equal opportunity employer. To ensure full implementation of its equal employment policy, the Company will continue to take steps to assure that recruitment, hiring, assignment, promotion, compensation, and all other personnel decisions are made and administered without regard to race, religion, color, national origin, citizenship, sex, sexual orientation, gender identity, gender expression, veteran status, age, mental or physical disability, genetic information or any other protected class.

Please be advised that certain US based positions, including without limitation field sales and service positions that call on hospitals and/or health care centers, require acceptable proof of COVID-19 vaccination status. Candidates will be notified during the interview and selection process if the role(s) for which they have applied require proof of vaccination as a condition of employment. Boston Scientific continues to evaluate its policies and protocols regarding the COVID-19 vaccine and will comply with all applicable state and federal law and healthcare credentialing requirements. As employees of the Company, you will be expected to meet the ongoing requirements for your roles, including any new requirements, should the Company’s policies or protocols change with regard to COVID-19 vaccination.