Sr IAM Architect

Title: IAM Architect
Location: Weston, Florida (3 days onsite, hybrid)
Duration: Long-term contract

Role Summary:

• The Client is seeking a senior Identity and Access Management Architect to assess, modernize, and improve its user provisioning environment.
  
• The architect will design secure, scalable, and reliable identity lifecycle processes across Workday, Banner, Active Directory, Microsoft Entra ID, OneLogin, and downstream applications.
  
• The role requires strong hands-on provisioning expertise to establish authoritative identity sources, automate joiner/mover/leaver processes, support employee and student identities, including dual affiliations, and implement monitoring, reconciliation, error handling, and deprovisioning safeguards.
  
• The architect will define the target-state IAM architecture, create a phased modernization roadmap, and guide implementation according to modern IAM, security, governance, and least-privilege practices.
  

Job Description:

• 8+ years of enterprise IAM experience, with significant responsibility for identity architecture and user-provisioning design.
  
• Proven ability to assess an existing provisioning environment and design a modern, scalable target-state architecture.
  
• Expert knowledge of end-to-end user provisioning across HR/SIS systems, identity platforms, directories, and downstream applications.
  
• Experience designing joiner, mover, leaver, rehire, return, and deprovisioning processes.
  
• Experience handling complex identity scenarios, including employee/student dual affiliations, duplicate identities, role changes, and multiple source records.
  
• Experience establishing authoritative identity sources and ownership rules for critical identity attributes.
  
• Strong experience integrating Workday, Banner, or comparable HRIS, SIS, and ERP platforms with IAM systems.
  
• Expert knowledge of Microsoft Entra ID, Active Directory, Entra Connect, Cloud Sync, and cross-tenant synchronization.
  
• Experience designing automated provisioning using SCIM, APIs, Microsoft Graph, PowerShell, SQL, file-based integrations, and middleware.
  
• Experience implementing provisioning safeguards, including reconciliation, validation, approval gates, retry processing, error handling, rollback, and mass-deletion protection.
  
• Ability to design monitoring and alerting for failed provisioning, synchronization issues, duplicate identifiers, stale accounts, and incomplete lifecycle events.
  
• Experience defining modern access-assignment models using roles, groups, attributes, access packages, and least-privilege principles.
  
• Strong understanding of authentication, provisioning, authorization, and identity governance as separate but connected functions.
  
• Expertise with SAML, OIDC/OAuth, SCIM, LDAP, and Kerberos.
  
• Experience modernizing legacy IAM platforms, custom scripts, databases, manual workflows, and duplicated provisioning logic.
  
• Ability to define the appropriate long-term roles of on-premises AD, Entra ID, multiple tenants, and legacy identity platforms.
  
• Experience designing identity governance, access reviews, privileged access, service-account governance, and timely access removal.
  
• Ability to create current-state and target-state architecture, identity-flow diagrams, source-of-authority matrices, attribute mappings, and lifecycle standards.
  
• Ability to produce a prioritized, phased modernization roadmap that can be realistically implemented without disrupting production.
  
• Hands-on technical ability to review configurations and code, analyze identity data, troubleshoot provisioning failures, lead proofs of concept, and guide implementation.
  
• Strong communication and knowledge-transfer skills for working with technical teams, business owners, leadership, and vendors.