Role Description The Senior Modern Workplace Identity Platform Engineer is responsible for designing, owning, and continuously improving the organization’s Microsoft identity platform. This role focuses on: - Identity architecture - Microsoft Entra ID - Conditional Access - Identity governance - Privileged access - Application identity - Lifecycle automation - Graph-based automation - Secure integration patterns across the Modern Workplace ecosystem The senior engineer acts as a technical owner for identity platform standards, automation patterns, governance controls, and complex troubleshooting. Responsibilities Success in this role means: - Identity is automated, auditable, secure, and scalable. - Access governance is based on real access state, not assumptions. - Privileged access is controlled, reviewed, and minimized. - SSO and application identity patterns are standardized. - Identity lifecycle processes are repeatable across users, guests, admins, service accounts, and applications. - Manual identity operations are replaced with automation wherever possible. - Identity platform decisions improve security without creating unnecessary business friction. - Tenant to tenant migrations – seamless and repeatable templates for multi-tenant organization. Key Responsibilities: - Identity Architecture & Platform Ownership: - Design and own Microsoft Entra ID architecture, standards, and operating models. - Define identity platform patterns for users, groups, guests, administrators, service principals, managed identities, and workload identities. - Design scalable models for groups, administrative units, RBAC, ABAC, access packages, and role assignments. - Define standards for naming, ownership, lifecycle, access reviews, privileged access, and identity documentation. - Lead identity platform improvements across Microsoft 365, Azure, and integrated business applications. - Authentication, Conditional Access & Zero Trust: - Design and maintain Conditional Access strategy. - Define MFA, passwordless, session control, device-based access, location-based access, and risk-based access patterns. - Align identity controls with Zero Trust principles. - Review and improve authentication security posture. - Lead troubleshooting for complex authentication, authorization, token, claims, and access issues. - Partner with security teams on identity protection, risky users, risky sign-ins, and control improvements. - Tenant-to-tenant migration capability: - Design, standardize, and support repeatable migration patterns for multi-tenant organizations, including users, groups, mailboxes, Teams, SharePoint/OneDrive, enterprise applications, app registrations, Conditional Access, identity governance, and access models. - Build reusable templates, runbooks, automation scripts, validation checks, and cutover procedures to make tenant migrations predictable, secure, auditable, and scalable. - Application Identity & Integration: - Own standards for enterprise applications, app registrations, service principals, API permissions, certificates, secrets, and consent. - Design secure SSO patterns using SAML, OAuth 2.0, OIDC, and SCIM. - Define application onboarding requirements for identity, access, provisioning, ownership, and review. - Lead complex SSO and provisioning troubleshooting. - Review application identity designs and challenge insecure or non-scalable patterns. - Define secure patterns for workload identity, managed identity, and service-to-service authentication. - Identity Lifecycle Automation: - Design and improve joiner, mover, leaver, contractor, guest, admin, and service identity lifecycle processes. - Build and govern automation using Microsoft Graph, PowerShell, Azure Functions, Logic Apps, Azure Automation, and CI/CD pipelines. - Create reusable automation modules for provisioning, deprovisioning, access changes, reporting, cleanup, and validation. - Design event-driven workflows for identity lifecycle and access governance. - Reduce dependency on manual identity operations. - Ensure automation is documented, maintainable, monitored, and auditable. - Access Governance & Privileged Access: - Design and operate access governance using Microsoft Entra ID Governance. - Own access review, entitlement management, access package, lifecycle workflow, and approval models. - Define privileged access strategy using Microsoft Entra PIM. - Design admin account models, break-glass procedures, role activation policies, and privileged access reviews. - Build reporting for actual access state, privileged access drift, stale permissions, orphaned ownership, and risky assignments. - Partner with audit, compliance, and security teams to provide evidence and improve controls. - Reporting, Monitoring & Compliance: - Define meaningful identity platform reporting. - Build reports showing access state across users, groups, roles, applications, guests, and privileged assignments. - Use KQL, Log Analytics, Sentinel, Entra logs, and Microsoft Graph for visibility and investigation. - Monitor identity platform health, risk signals, failed provisioning, failed sign-ins, and policy impact. - Lead root cause analysis for major identity incidents. - Maintain audit-ready documentation, diagrams, runbooks, and control evidence. - Device Identity & Modern Workplace Integration: - Define identity requirements for Entra join, hybrid join, registered devices, and device-based Conditional Access. - Collaborate with endpoint management teams on compliance signals, device identity, and access control requirements. - Ensure device identity is correctly used as part of the broader identity security model. - Troubleshoot complex access issues involving user identity, device identity, compliance state, and Conditional Access. - Technical Leadership: - Mentor identity engineers and operations teams. - Review scripts, designs, policies, access models, and automation workflows. - Translate business, audit, and security requirements into scalable identity platform solutions. - Provide technical direction for identity-related projects, migrations, integrations, and platform improvements. - Challenge weak designs and promote secure, simple, repeatable patterns. - Act as escalation point for complex identity and access issues. Qualifications - Strong experience with Microsoft Entra ID architecture and operations for at least 5 years. - Strong understanding of identity and access management principles. - Strong experience with Conditional Access, MFA, passwordless authentication, identity protection, and Zero Trust controls. - Strong experience with enterprise applications, app registrations, service principals, API permissions, certificates, secrets, and consent. - Strong experience with SAML, OAuth 2.0, OIDC, SCIM, claims, tokens, and application SSO troubleshooting. - Strong PowerShell and Microsoft Graph API skills. - Experience designing identity lifecycle automation. - Experience with Microsoft Entra PIM, access reviews, entitlement management, and access governance. - Ability to troubleshoot complex identity issues using logs, traces, audit events, sign-in logs, provisioning logs, and KQL. - Ability to design scalable standards, not just resolve individual tickets. - Strong documentation, mentoring, and stakeholder management skills. Nice to Have - Experience with Microsoft Entra ID Governance and Lifecycle Workflows. - Experience with Azure Functions, Logic Apps, Event Grid, queues, or webhook-based automation. - Experience with Azure DevOps, GitHub Actions, or CI/CD-based automation. - Experience with Terraform or Infrastructure as Code. - Experience with Microsoft Sentinel and advanced KQL. - Experience with cross-tenant migrations, tenant consolidation, or M&A identity scenarios. - Experience with admin tiering, privileged access workstations, break-glass models, and delegated administration. - Experience with managed identities, workload identities, and Azure service authentication. - Familiarity with device identity, Entra join, hybrid join, and compliance-based Conditional Access. - Familiarity with Microsoft 365 security and compliance capabilities. Tools & Technologies - Microsoft Entra ID - Microsoft Entra ID Governance - Conditional Access - MFA / Passwordless Authentication - Identity Protection - PIM - Access Reviews - Entitlement Management - Lifecycle Workflows - Enterprise Applications - App Registrations - Service Principals - Managed Identities - Workload Identities - Microsoft Graph API - PowerShell - Azure Automation - Azure Functions - Logic Apps - Event Grid - Azure DevOps / GitHub - KQL / Log Analytics - Microsoft Sentinel - Microsoft 365

• Build and maintain MLOps automation end-to-end: CI/CD for models and pipelines, environment management, artifact versioning (models, data, prompts, code), and release governance • Implement and operate model serving infrastructure: deployment patterns (blue/green, canary, shadow), endpoint management, scaling, and latency/throughput optimisation • Build and maintain training and experimentation infrastructure: job orchestration, compute provisioning, experiment tracking, hyperparameter management, and reproducibility tooling • Implement observability for ML systems: data quality checks, feature drift detection, model performance monitoring, bias checks, alerting, and incident response workflows • Build and maintain data pipelines for ingestion, transformation, feature engineering, and export across multiple sources and destinations • Design and maintain a feature store or feature platform layer: serving consistency, point-in-time correctness, and reuse across teams • Expose well-governed datasets, features, and APIs that models, pipelines, and downstream consumers can rely on • Enforce secure data handling and compliance with relevant data protection standards, access controls, and audit requirements • Contribute to documentation, platform standards, and continuous improvement of ML engineering processes across teams

• Build and maintain MLOps automation end-to-end: CI/CD for models and pipelines, environment management, artifact versioning (models, data, prompts, code), and release governance • Implement and operate model serving infrastructure: deployment patterns (blue/green, canary, shadow), endpoint management, scaling, and latency/throughput optimisation • Build and maintain training and experimentation infrastructure: job orchestration, compute provisioning, experiment tracking, hyperparameter management, and reproducibility tooling • Implement observability for ML systems: data quality checks, feature drift detection, model performance monitoring, bias checks, alerting, and incident response workflows • Build and maintain data pipelines for ingestion, transformation, feature engineering, and export across multiple sources and destinations • Design and maintain a feature store or feature platform layer: serving consistency, point-in-time correctness, and reuse across teams • Expose well-governed datasets, features, and APIs that models, pipelines, and downstream consumers can rely on • Enforce secure data handling and compliance with relevant data protection standards, access controls, and audit requirements • Contribute to documentation, platform standards, and continuous improvement of ML engineering processes across teams

CAPCO POLANDWe are looking for a Poland-based candidate. This is hybrid role 1-2 times from Kraków office per month. At Capco Poland, we're not just another consultancy – we're the spark behind digital transformation in the financial world. As a global leader in technology and management consulting, we help clients tackle complex challenges across banking, payments, capital markets, wealth, and asset management. ROLE OVERVIEWWe are seeking an experienced AI Agent Engineer (Power Platform & Copilot Studio) to join our growing team and support the development of AI-driven automation solutions across enterprise business processes. This role requires strong hands-on experience with Microsoft Power Platform, particularly Copilot Studio, alongside a solid understanding of Generative AI concepts and conversational AI development. You will be responsible for designing, developing, and deploying intelligent AI agents that improve operational efficiency, enhance user experiences, and drive business value. Working in an Agile environment, you will collaborate closely with business stakeholders, product owners, and technology teams to deliver scalable, secure, and high-quality AI solutions aligned with best practices and governance standards. KEY RESPONSIBILITIESAI Agent Development - Design, develop, and deploy AI agents and automation solutions to support business process optimization. - Build and maintain conversational AI solutions using Microsoft Copilot Studio and the wider Power Platform ecosystem. - Design effective conversational flows and user experiences. - Integrate AI solutions with enterprise applications, APIs, and business processes. - Implement monitoring, analytics, and continuous improvements to enhance solution performance and adoption. Solution Delivery - Collaborate with business and technology stakeholders to gather requirements and define solution designs. - Translate business needs into scalable and maintainable AI-powered solutions. - Ensure solutions follow software development best practices, including documentation, testing, and code quality standards. - Support deployment, maintenance, and enhancement of existing solutions. Governance & Innovation - Ensure compliance with security, privacy, and governance requirements. - Promote responsible AI practices, including transparency, explainability, and ethical AI principles. - Stay up to date with emerging AI technologies and recommend innovative approaches and tools. - Contribute to technical standards, best practices, and knowledge sharing across teams. KEY REQUIREMENTSTechnical Skills - Proven experience developing and deploying AI agents, chatbots, virtual assistants, or conversational AI solutions. - Strong hands-on experience with Microsoft Copilot Studio and Microsoft Power Platform (Power Apps, Power Automate, Power BI). - Strong understanding of Generative AI concepts, including RAG (Retrieval-Augmented Generation), prompt engineering, and LLM-based solutions. - Experience integrating AI solutions with enterprise systems, APIs, and cloud services. - Familiarity with Microsoft Azure and related AI services. - Understanding of secure development practices, testing approaches, and performance monitoring. - Experience implementing analytics and monitoring for AI-driven solutions. - Knowledge of programming languages such as Python, C#, or JavaScript is an advantage. - Experience working in Agile environments and using tools such as Jira or Azure DevOps. Professional Skills - Proven experience in a similar AI Engineering, Automation, or Power Platform development role. - Strong problem-solving and analytical skills. - Ability to communicate complex technical concepts to both technical and non-technical audiences. - Excellent stakeholder management and collaboration skills. - Ability to work independently and manage multiple priorities in a fast-paced environment. - Strong written and verbal communication skills in English. Nice to Have - Experience within banking, financial services, or regulated environments. - Knowledge of Responsible AI frameworks and governance practices. - Microsoft certifications related to Power Platform, Azure AI, or Copilot Studio. WHAT WE OFFERWe offer a flexible collaboration model based on a B2B contract, with the opportunity to work on innovative AI and automation initiatives for leading financial institutions. RECRUITMENT PROCESS - HR Interview with Recruiter - Technical Interview with Hiring Manager - Client Interview - Feedback and Offer Joining Capco means joining an organization that is committed to an inclusive working environment where you're encouraged to #BeYourselfAtWork. #LI-HYBRID