<div class="content-intro"><p><strong>About Nebius:</strong></p> <p>Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure.</p> <p>Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI.</p> <p>Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D.</p></div><p><strong>About the Role</strong></p> <p>You own the company's identity provider: who signs in, from where, with which factors, into which applications — and how that access is granted, reviewed, and revoked.</p> <p>Microsoft Entra ID is the primary identity plane and the center of gravity for the role. Google Workspace, Cloud Identity, and Google Cloud IAM form a second substantial domain, and you own the federation and provisioning path between them. Microsoft 365 is in scope for tenant, licensing, and access administration.</p> <p>You are the escalation point for identity incidents from operations, security, service desk, and application teams — expected to resolve them, not route them onward.</p> <p><strong>What You'll Own</strong></p> <p>Microsoft Entra ID and Microsoft 365</p> <ul> <li>Users, dynamic and assigned groups, administrative units, directory roles, service principals, workload identities.</li> <li>Conditional Access design and rollout: named locations, client app and platform conditions, session controls, sign-in frequency, break-glass exclusions, report-only staging.</li> <li>Authentication methods policy and phishing-resistant factors.</li> <li>Application onboarding over SAML 2.0 (NameID, claims mapping, signing certificate rollover, encrypted assertions) and OIDC / OAuth 2.0 (authorization code with PKCE, client credentials, device code).</li> <li>App registrations: redirect URIs, permissions, admin consent workflow, secret and certificate lifecycle. – SCIM 2.0 provisioning: attribute mappings, scoping filters, expression transformations, quarantined jobs, drift reconciliation.</li> <li>Tenant consent settings, OAuth grant review, remediation of over-permissioned and stale applications; defensible controls for SaaS without SSO or SCIM support.</li> <li>Joiner-mover-leaver as an automated pipeline: provisioning, group-based licensing, revocation with session and refresh token invalidation.</li> <li>Least privilege for admin access: scoped role assignments, RBAC, PIM, access reviews, entitlement management access packages.</li> <li>Service account and workload identity governance: ownership, credential rotation, permission scoping, decommissioning.</li> <li>Microsoft 365 tenant settings, licensing, admin roles; access and permission issues in Exchange Online, SharePoint Online, Power Platform.</li> <li>Diagnostics from sign-in, audit, and provisioning logs, with diagnostic settings routed to Log Analytics and KQL queries.</li> <li>Cross-tenant access settings and B2B external collaboration.</li> </ul> <p>Google Workspace, Cloud Identity, and Google Cloud</p> <ul> <li>Google Workspace and Cloud Identity: users, groups, organizational units, admin roles and privileges, licensing, 2-Step Verification enforcement, session controls.</li> <li>Third-party SSO profiles with Microsoft Entra ID as SAML IdP, automated provisioning into Cloud Identity, OU- and group-scoped SSO exclusions.</li> <li>Context-Aware Access policies, third-party OAuth app access control, domain-wide delegation, Drive sharing and external access controls. 2</li> <li>Google Cloud IAM: project and folder membership, predefined and custom roles, allow policies, service accounts and key hygiene, workload identity federation, API enablement, OAuth clients.</li> </ul> <p>Automation </p> <ul> <li>PowerShell tooling on the Microsoft Graph PowerShell SDK and Graph REST API: lifecycle, licensing, access reporting, recertification.</li> <li>Google-side automation through the Admin SDK Directory API, Cloud Identity API, and gcloud.</li> <li>Scheduled and event-driven workflows in Azure Automation Runbooks, Azure Logic Apps, or Power Automate.</li> <li>Unattended execution on managed identities and narrowly scoped app registrations, with credential rotation, structured logging, error handling, and retries.</li> <li>Automation treated as production code: version control, peer review, documented rollback.</li> </ul> <p><strong>What You'll Bring</strong></p> <p>We care about what you can do, not which products appear on your CV. Concretely, you can:</p> <ul> <li>Decode a SAML assertion or JWT and pinpoint the failure — audience mismatch, NameID format, expired signing certificate, missing claim — without escalating to the vendor.</li> <li>Diagnose a failing SCIM job and tell scoping from attribute mapping, transformation expressions, or target schema.</li> <li>Replace a manual lifecycle process with automation that logs, retries, and can be handed to someone else to run.</li> </ul> <p>Experience We Expect</p> <ul> <li&