Senior Identity and Access Management Consultant

We're Hiring

Aon is seeking a Senior Identity and Access Management (IAM) Consultant to join our Digital M&A Advisory practice in London.

The team advises private equity investors, infrastructure funds and corporate clients on technology, IT, cyber and digital risks across acquisitions, portfolio companies and strategic transformation initiatives. Our work spans cyber due diligence, technical cyber reviews, cyber risk assessments, identity and infrastructure security reviews, separation and integration support, and post-transaction cyber value creation.

This role is ideally suited to a technically strong identity specialist with hands-on experience building, administering and assessing Active Directory and wider identity environments, including identity lifecycle (Joiner-Mover-Leaver) processes, privileged access and hybrid cloud identity. Previous M&A experience is not required.

You will act as the technical IAM lead on our engagements, working directly with investors, CISOs, infrastructure and identity teams and C-suite executives to assess identity security posture, identify exposures and translate technical findings into clear business and investment implications.

This is a fast-paced, client-facing role offering significant exposure to a broad range of industries, identity environments and technologies.

About Aon

Headquartered in London, Aon Plc is a leading global professional services firm providing a broad range of risk, retirement and health solutions. Our 50,000 colleagues in 120 countries empower results for clients by using proprietary data and analytics to deliver insights that reduce volatility and improve performance.

Aon is an equal opportunities employer. Aon's recruitment and selection policy ensures the best possible skill mix of colleagues and the highest quality candidates are appointed using objective job-related criteria.

About the Role

• Your impact as a Senior Identity and Access Management Consultant:
• You will be responsible for leading the identity and access management elements of engagements across private equity and corporate clients, including:
• Leading technical identity and access management reviews as part of cyber due diligence, technical review and portfolio company engagements.
• Assessing Active Directory design and security, including forest and domain architecture, trusts, OU structure, Group Policy, domain controller security and tiered administration models.
• Reviewing security group design and membership, including privileged groups (e.g. Domain Admins, Enterprise Admins), nested groups, delegated permissions and excessive or inherited access.
• Assessing account management against best practice, including privileged, service, shared, generic, stale and dormant accounts, password policies, credential hygiene and account naming and ownership standards.
• Reviewing Joiner-Mover-Leaver (JML) processes, including HR-driven provisioning, timeliness of de-provisioning, role changes, access recertification and alignment between HR and IT records.
• Evaluating privileged access management (PAM), including just-in-time access, credential vaulting, session monitoring and break-glass accounts.
• Assessing hybrid and cloud identity, including Microsoft Entra ID, Entra Connect synchronisation, conditional access, MFA coverage, SSO and federation.
• Reviewing identity governance and administration (IGA), including role-based access control, segregation of duties and access review processes.
• Translating technical findings into prioritised, commercially relevant risks, remediation roadmaps and cost estimates for investors and management teams.
• Producing high-quality reports, presentations and executive briefings.
• Leading technical workstreams and supporting engagement delivery across multiple concurrent projects.
• Working closely with colleagues across technology, cyber, M&A and risk advisory disciplines.
• Contributing to the development of the team's technical review methodologies, identity assessment tooling and market offerings.
• Supporting client engagements across the UK and EMEA.

About you

Your knowledge and expertise

Technical

• Demonstrable experience in identity and access management, Active Directory engineering, infrastructure security, security consulting or a related technical role.
• Strong, hands-on experience building, administering, securing and assessing Active Directory environments, including security groups, delegation and account management best practices.
• Practical experience designing, operating or assessing Joiner-Mover-Leaver (JML) processes and identity lifecycle controls.
• Experience designing, implementing or assessing one or more of the following:
• Active Directory architecture, trusts, Group Policy and tiered administration
• Security group design, delegation and least-privilege access
• Privileged, service and shared account management
• Microsoft Entra ID, Entra Connect and hybrid identity
• Conditional access, MFA, SSO and federation (e.g. ADFS, Okta, Ping)
• Privileged access management (e.g. CyberArk, BeyondTrust, Delinea, Entra PIM)
• Identity governance and administration (e.g. SailPoint, Saviynt, Entra ID Governance)
• JML automation and HR-to-identity integration
• Access recertification and segregation of duties
• AD recovery, backup and resilience
• Familiarity with one or more of the following frameworks and best practices:
• Microsoft Enterprise Access Model and tiered administration guidance
• CIS Benchmarks and CIS Critical Security Controls
• NIST CSF and NIST SP 800-63 (Digital Identity Guidelines)

NIST SP 800-207 (Zero Trust Architecture)

ISO 27001

• NCSC identity and access management guidance
• Understanding of common identity attack techniques (e.g. Kerberoasting, pass-the-hash, credential theft, privilege escalation, abuse of ACLs and delegation) and how they impact critical business assets.
• Ability to interpret AD exports, PowerShell output, group membership reports and outputs from AD assessment tools.
• Experience identifying and assessing identity and cyber risks within sophisticated environments, with the ability to communicate technical findings and business implications to both technical and non-technical stakeholders.
• Strong analytical and problem-solving skills.
• Commercial awareness and the ability to understand business implications of technology and security decisions.
• Excellent written and verbal communication skills with the ability to convey complex technical concepts to non-technical audiences.

Team & Client Management

• Experience managing technical workstreams and contributing to successful project delivery.
• Strong stakeholder management and presentation skills.
• Ability to engage effectively with both technical teams and senior business executives.
• Experience developing positive client relationships.
• Comfortable working within multidisciplinary and global teams and fast-paced consulting environments.
• Ability to handle multiple engagements and competing priorities.
• Highly organised with strong attention to detail and quality.

Highly Desirable

• Experience of AD consolidation, domain or tenant-to-tenant migrations, or identity separation and integration programmes.
• Exposure to attack path analysis, exposure management or cyber risk quantification platforms.
• Experience of AD security assessments, compromise recovery or identity-focused incident response.
• Experience with AWS IAM or Google Cloud identity in multi-cloud environments.

Industry-recognised certifications, such as

Microsoft Certified: Identity and Access Administrator Associate (SC-300)

Microsoft Certified: Cybersecurity Architect Expert (SC-100)

CyberArk Defender / Sentry

SailPoint Certified IdentityIQ Engineer

CISSP

CISM

• Experience working with private equity-backed businesses or large corporate organisations.
• Experience mentoring junior team members or supporting team development initiatives.
• Interest in business development and market-facing activities. Experience or interest in line management and supporting client relationship management.

What Success Looks Like

• Delivering high-quality, technically robust identity and access management reviews for private equity and corporate clients.
• Acting as the go-to identity security expert across engagements.
• Building trusted relationships with client technology, security and business stakeholders.
• Providing insightful, commercially relevant recommendations that support investment and operational decision-making.
• Contributing to the growth and development of the Digital M&A Advisory practice and its technical capabilities.
• Supporting the development of junior colleagues and enhancing team capabilities.

#li-nw1

2586438