Cybersecurity Senior IAM Architect

Key Responsibilities

• Provide enterprise architecture leadership for Active Directory, Microsoft Entra ID, Microsoft 365, and hybrid identity services.
• Define, design, and govern secure and resilient identity capabilities across on-premises and cloud environments.
• Own the end-to-end strategy for directory services, Entra Privileged Identity Management (PIM), authentication, identity operations, and identity integrations.
• Serve as a senior technical decision-maker and SME for identity architecture, establishing standards for MFA, Conditional Access, modern authentication, lifecycle controls, and Zero Trust while meeting operational needs and regulatory obligations.
• Lead the design and architecture of Active Directory and Entra ID hybrid environments, including domain and forest strategy, AD and Entra migrations and consolidations, tenant integration, identity synchronization, and identity transition planning for mergers, acquisitions, and divestitures.
• Architect high availability, disaster recovery, and scalability models for identity systems.
• Drive modernization efforts such as legacy domain remediation, AD hardening, cloud identity integration, and secure Microsoft 365 administrative architecture.
• Develop and enforce controls for tiered administration, privileged role activation through Entra PIM, PAWs, AD tiering, credential protection, MFA, Conditional Access, and attack surface reduction.
• Lead initiatives to reduce identity-based risk, including privileged account sprawl, excessive standing access, stale accounts, and unmanaged service or non-human identities.
• Drive adoption of passwordless and modern authentication technologies, including MFA, FIDO2, and Windows Hello for Business.
• Architect integration among Active Directory, Entra ID, Microsoft 365, IAM and identity governance platforms, identity security tools, and enterprise applications.
• Define identity and access architecture standards across Microsoft Azure, AWS, and GCP, including workforce access, privileged roles, workload identities, federation, and governance.
• Oversee identity integration across on-premises, cloud, SaaS, and third-party systems, with appropriate PAM integration when privileged identities are in scope.
• Ensure consistent identity governance across platforms for human, service, workload, and other non-human identities.
• Provide expert escalation support for complex AD-related issues, including AD health, performance, and security audits, remediation, and optimization.
• Ensure identity platforms meet applicable regulatory and security standards, including SOX, PCI, and NIST.
• Support identity incidents end-to-end, including AD compromise, credential attacks, Entra role misuse, authentication failures, and identity service disruptions, including root cause analysis and remediation.
• Establish monitoring, alerting, and response procedures for identity infrastructure and identity threat detections, integrating identity telemetry with SIEM and security teams.
• Develop and maintain architectural documentation, standards, and design patterns, and provide executive-level reporting on identity security posture, risks, and initiatives.

Requirements

• Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent work experience.
• 7+ years of experience in identity and access management, directory services, identity security, or related enterprise architecture roles.
• Deep expertise in Active Directory and Microsoft Entra ID, including hybrid identity, identity synchronization, authentication, directory security, and enterprise-scale architecture.
• Required experience designing and governing Entra Privileged Identity Management (PIM), privileged role activation, approval, access review, and least-privilege controls.
• Strong knowledge of Microsoft 365 administration and architecture, including identity, role, authentication, and security dependencies across the platform.
• Knowledge of cloud IAM concepts and access models across Microsoft Azure, AWS, and GCP, including federation, privileged roles, workload identities, and governance (deep expertise in every cloud platform not required).
• Strong experience with identity operations and security controls, including MFA, Conditional Access, SSO, federation, passwordless authentication, identity lifecycle, access governance, and monitoring.
• Working knowledge of privileged access management concepts and the ability to provide AD, Entra, and privileged-identity requirements to PAM platform teams. Familiarity with CyberArk or an equivalent PAM platform is beneficial.
• Knowledge of applicable regulatory and security frameworks, including SOX, PCI, and NIST.
• Knowledge of AI-related identity risks and controls is preferred, including workload identities, service accounts, machine identities, and other non-human identities.
• Awareness of agentic AI security is a plus, including agent identities, delegated permissions, credential handling, and human oversight.
• Experience with CrowdStrike Identity Threat Protection or other identity threat detection and response or identity security tools is a plus.
• Experience with scripting and automation (for example, PowerShell or Python) is a plus.
• Strong troubleshooting, problem-solving, and analytical skills.
• Excellent communication skills with the ability to collaborate cross-functionally and present technical information to non-technical stakeholders.
• Experience leading enterprise identity architecture, modernization, security, or operational improvement initiatives.
• Significant experience supporting mergers, acquisitions, divestitures, or other large-scale Active Directory and Entra migrations and consolidations is a strong plus, including tenant, domain, forest, identity synchronization, coexistence, and transition planning.

Relevant Technologies

Active Directory (AD), Microsoft Entra ID, Microsoft 365, Entra Privileged Identity Management (PIM), MFA, Conditional Access, Zero Trust, FIDO2, Windows Hello for Business, PAWs, Microsoft Azure, AWS, GCP, SSO, SAML, OIDC, OAuth, GPO, DNS, SOX, PCI, NIST, SIEM, CrowdStrike Identity Threat Protection, CyberArk, PowerShell, Python.