Sr IAM Architect

Job Description

Company: 3Core Systems , Inc

About the position
The Client is seeking a senior Identity and Access Management Architect to assess, modernize, and improve its user-provisioning environment. The architect will design secure, scalable, and reliable identity lifecycle processes across Workday, Banner, Active Directory, Microsoft Entra ID, OneLogin, and downstream applications.nnThe role requires hands-on provisioning expertise to establish authoritative identity sources; automate joiner, mover, and leaver processes; support employee and student identities, including dual affiliations; and implement monitoring, reconciliation, error handling, and deprovisioning safeguards.nnThe architect will define the target-state IAM architecture, create a phased modernization roadmap, and guide implementation in accordance with modern IAM, security, governance, and least-privilege practices. The position is a long-term contract based in Weston, Florida, with three days onsite and a hybrid work arrangement.
Responsibilities
• Assess the existing user-provisioning environment and design a modern, scalable target-state IAM architecture.
• Design end-to-end identity provisioning across HR/SIS systems, identity platforms, directories, and downstream applications.
• Design joiner, mover, leaver, rehire, return, and deprovisioning processes, including complex employee/student dual affiliations and duplicate identities.
• Establish authoritative identity sources and ownership rules for critical identity attributes.
• Design integrations between HRIS, SIS, and ERP platforms and IAM systems.
• Design automated provisioning using SCIM, APIs, Microsoft Graph, PowerShell, SQL, file-based integrations, and middleware.
• Implement provisioning safeguards such as reconciliation, validation, approval gates, retry processing, error handling, rollback, and mass-deletion protection.
• Design monitoring and alerting for failed provisioning, synchronization issues, duplicate identifiers, stale accounts, and incomplete lifecycle events.
• Define modern access-assignment models using roles, groups, attributes, and access packages, applying least-privilege principles.
• Define the long-term roles of on-premises Active Directory, Entra ID, multiple tenants, and legacy identity platforms.
• Design identity governance, access reviews, privileged access, service-account governance, and timely access removal.
• Create current-state and target-state architecture, identity-flow diagrams, source-of-authority matrices, attribute mappings, and lifecycle standards.
• Produce a prioritized, phased modernization roadmap that can be implemented without disrupting production.
• Review configurations and code, analyze identity data, troubleshoot provisioning failures, lead proofs of concept, and guide implementation.
• Work with technical teams, business owners, leadership, and vendors; provide communication and knowledge transfer.
Requirements
• At least 8 years of enterprise IAM experience, with significant responsibility for identity architecture and user-provisioning design.
• Proven ability to assess an existing provisioning environment and design a modern, scalable target-state architecture.
• Expert knowledge of end-to-end user provisioning across HR/SIS systems, identity platforms, directories, and downstream applications.
• Experience designing joiner, mover, leaver, rehire, return, and deprovisioning processes.
• Experience handling employee/student dual affiliations, duplicate identities, role changes, and multiple source records.
• Experience establishing authoritative identity sources and ownership rules for critical identity attributes.
• Strong experience integrating Workday, Banner, or comparable HRIS, SIS, and ERP platforms with IAM systems.
• Expert knowledge of Microsoft Entra ID, Active Directory, Entra Connect, Cloud Sync, and cross-tenant synchronization.
• Experience designing automated provisioning using SCIM, APIs, Microsoft Graph, PowerShell, SQL, file-based integrations, and middleware.
• Experience implementing provisioning safeguards, including reconciliation, validation, approval gates, retry processing, error handling, rollback, and mass-deletion protection.
• Ability to design monitoring and alerting for failed provisioning, synchronization issues, duplicate identifiers, stale accounts, and incomplete lifecycle events.
• Experience defining access-assignment models using roles, groups, attributes, access packages, and least-privilege principles.
• Strong understanding of authentication, provisioning, authorization, and identity governance as separate but connected functions.
• Expertise with SAML, OIDC/OAuth, SCIM, LDAP, and Kerberos.
• Experience modernizing legacy IAM platforms, custom scripts, databases, manual workflows, and duplicated provisioning logic.
• Ability to define the appropriate long-term roles of on-premises AD, Entra ID, multiple tenants, and legacy identity platforms.
• Experience designing identity governance, access reviews, privileged access, service-account governance, and timely access removal.
• Ability to create current-state and target-state architecture, identity-flow diagrams, source-of-authority matrices, attribute mappings, and lifecycle standards.
• Ability to produce a prioritized, phased modernization roadmap that can be realistically implemented without disrupting production.
• Hands-on technical ability to review configurations and code, analyze identity data, troubleshoot provisioning failures, lead proofs of concept, and guide implementation.
• Strong communication and knowledge-transfer skills for working with technical teams, business owners, leadership, and vendors.

Source: Teal