Senior Authentication Engineer (Entra)

NBCUniversal is one of the world's leading media and entertainment companies. We create world-class content, which we distribute across our portfolio of film, television, and streaming, and bring to life through our global theme park destinations, consumer products, and experiences. We own and operate leading entertainment and news brands, including NBC, NBC News, NBC Sports, Telemundo, NBC Local Stations, Bravo, and Peacock, our premium ad-supported streaming service. We produce and distribute premier filmed entertainment and programming through our powerhouse film and television studios, including Universal Pictures, DreamWorks Animation, and Focus Features, and the four global television studios under the Universal Studio Group banner, and operate industry-leading theme parks and experiences around the world through Universal Destinations & Experiences, including Universal Orlando Resort, home to Universal Epic Universe, and Universal Studios Hollywood. NBCUniversal is a subsidiary of Comcast Corporation. Visit www.nbcuniversal.com for more information. Our impact is rooted in improving the communities where our employees, customers, and audiences live and work. We have a rich tradition of giving back and ensuring our employees have the opportunity to serve their communities. We champion an inclusive culture and strive to attract and develop a talented workforce to create and deliver a wide range of content reflecting our world. Join the NBCUniversal Operations and Technology (O&T) team and help drive strategy for the growing Identity and Access Management (IAM) service portfolio. The Authentication Engineer is responsible for the design, implementation, operation, security, and continuous improvement of enterprise authentication services that protect NBCUniversal’s workforce, applications, data, and digital assets. This role serves as a technical expert for identity authentication technologies, ensuring highly available, secure, and scalable authentication platforms across cloud, on-premises, hybrid, and SaaS environments. The successful candidate will partner with Identity and Access Management (IAM), Cyber Security, Infrastructure, Application Development, and Workplace Technology teams to deliver modern authentication capabilities, strengthen the organization’s security posture, and provide an exceptional user experience. Responsibilities Design, implement, and manage enterprise authentication services, including Single Sign-On (SSO), Multi-Factor Authentication (MFA), Passwordless Authentication, Adaptive Authentication, and Federation services. Administer and support Microsoft Entra ID Authentication services and related identity platforms. Lead the deployment and adoption of modern authentication methods, including FIDO2 security keys, Windows Hello for Business, passkeys, certificate-based authentication (CBA), and passwordless solutions. Develop and maintain authentication standards, reference architectures, procedures, and operational runbooks. Strengthen the enterprise security posture by implementing authentication controls aligned with Zero Trust principles. Partner with Cyber Defense teams to investigate authentication-related security incidents. Analyze authentication telemetry, identify suspicious sign-in activity, and recommend mitigation strategies. Evaluate and implement new authentication technologies, security enhancements, and industry best practices. Ensure authentication platforms achieve high availability, resiliency, disaster recovery readiness, and operational excellence. Monitor service health, performance, capacity, and adoption metrics. Lead root cause analysis and problem management activities for service outages and incidents. Drive automation initiatives to improve operational efficiency and service quality. Design and support authentication integrations for SaaS, cloud-native, on-premises, custom, and third-party applications. Collaborate with application teams to onboard applications using standards such as SAML, OAuth 2.0, OpenID Connect (OIDC), WS-Federation, and SCIM. Contribute to enterprise authentication roadmaps and modernization initiatives. Identify opportunities to eliminate legacy authentication methods and adopt secure modern alternatives. Develop technical documentation, architecture diagrams, and implementation guidance. Qualifications/Requirements 5+ years of experience at the Engineer level implementing enterprise access management solutions. 3+ years of hands-on experience with Microsoft Entra ID authentication services. Bachelor’s or Master’s degree in computer science, information security, a related field, or equivalent work experience. Understanding of authentication protocols, including SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), Kerberos, WS-Federation, and LDAP. Demonstrated experience with Microsoft Entra ID, Active Directory, MFA technologies, federation services, Conditional Access, Identity Protection, and Privileged Identity Management. Experience implementing and supporting Passwordless authentication solutions. Understanding of cloud security and Zero Trust architecture principles. Working knowledge of SIEM tools such as Splunk, including running reports and configuring alerts. Ability to interpret complex designs and explain them at an executive level. Knowledge of networking concepts including DNS, TLS/SSL, certificates, proxies, and load balancing. Desired Characteristics 2+ years of experience with scripting languages (e.g., PowerShell, Python). Passionate about authentication, identity security, and emerging technologies. Strong troubleshooting skills with the ability to solve complex authentication and federation issues. Ability to translate business requirements into secure and scalable technical solutions. Continuously researches and evaluates industry trends and best practices. Experience with Azure, Google Cloud Platform (GCP), and Amazon Web Services (AWS). Experience with large-scale identity verification solutions for enterprises. One or more Azure or Microsoft Security certifications preferred, such as AZ-900, AI-900, AZ-500, SC-300, or AZ-305. Knowledge of integrating AI agents with identity providers and applying governance to their access and lifecycle management. Ability to apply AI-driven analytics to strengthen identity governance, enable intelligent access decisions, detect anomalous behavior, and optimize end-to-end IAM workflows. Strong communication and presentation skills with the ability to engage technical and non-technical audiences. Demonstrates ownership, accountability, and a customer-first mindset with a focus on security. Influences without authority and builds strong partnerships across the organization. Focused on service reliability, operational excellence, and automation. Maintains composure and effectiveness during high-severity incidents and outages. Uses data-driven decision-making to improve service performance and user experience. Additional Requirements: Fully Remote : This position has been designated as fully remote, meaning that the position is expected to contribute from a non-NBCUniversal worksite, most commonly an employee’s residence. This position is eligible for company sponsored benefits, including medical, dental and vision insurance, 401(k), paid leave, tuition reimbursement, and a variety of other discounts and perks. Learn more about the benefits offered by NBCUniversal by visiting the Benefits page of the Careers website. Salary range: $105,000 - $135,000 We are accepting applications for this position on an ongoing basis. As part of our selection process, external candidates may be required to attend an in-person interview with an NBCUniversal employee at one of our locations prior to a hiring decision. NBCUniversal's policy is to provide equal employment opportunities to all applicants and employees without regard to race, color, religion, creed, gender, gender identity or expression, age, national origin or ancestry, citizenship, disability, sexual orientation, marital status, pregnancy, veteran status, membership in the uniformed services, genetic information, or any other basis protected by applicable law. If you are a qualified individual with a disability or a disabled veteran, you have the right to request a reasonable accommodation if you are unable or limited in your ability to use or access nbcunicareers.com as a result of your disability. You can request reasonable accommodations by emailing [email protected]. For LA County and City Residents Only: NBCUniversal will consider for employment qualified applicants with criminal histories, or arrest or conviction records, in a manner consistent with relevant legal requirements, including the City of Los Angeles' Fair Chance Initiative For Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act, where applicable.