Identity and Access Management Technical Expert

About the Role
The IAM Technical Expert is a senior hands-on expert responsible for the architecture, detailed solution design, integrated technical implementation, and orchestration of enterprise Identity and Access Management (IAM), Privileged Access Management (PAM), and Identity Governance and Administration (IGA) capabilities. This role leads secure identity integration across key platforms, driving phased deployment, engineering quality, automation, and operational readiness, while establishing sustainable services.

Major Responsibilities
Enterprise Identity Architecture & Technical Direction

• Own the end-to-end IAM, PAM and IGA target architecture, reference designs, implementation principles, and phased technical roadmap aligned with security strategies and Zero Trust principles.
• Define trust boundaries, identity data flows, authoritative sources, integration patterns, identity stores, and control ownership across on-premises, hybrid and multi-cloud environments.
• Act as design authority for cross-platform technical decisions, technical debt, interoperability, resilience, and engineering standards; maintain current architecture diagrams and decision records.
• Design for complex identity populations including staff, faculty, students, researchers, visiting scholars, affiliates, contractors, service identities, and external collaborators.

IAM: Authentication, Federation & Access Architecture

• Lead Microsoft Entra architecture and hands-on engineering for workforce identities, hybrid identity synchronization, single sign-on, federation, MFA, Conditional Access, and identity protection.
• Define secure authentication and authorization patterns using SAML 2.0, OAuth 2.0, OpenID Connect, FIDO2/passkeys, SCIM, LDAP, and API-based integrations.
• Engineer application onboarding patterns, group and attribute-based access, delegated administration, break-glass access, and recovery controls.
• Integrate identity services with enterprise applications, cloud platforms, collaboration tools, research platforms, laboratory systems, and external federation ecosystems.

PAM: Privileged Access Architecture & Engineering

• Lead PAM platform evaluation, design, implementation, and integration, including privileged discovery, account and secret onboarding, secure credential vaulting, and automated credential rotation.
• Engineer privileged session brokering, recording and monitoring; just-in-time/just-enough administration; approval workflows and privileged elevation for infrastructure and cloud.
• Address administrators, root/service accounts, local and domain privileged accounts, application credentials, machine identities, secrets, API keys, and emergency access.
• Design PAM integrations with Entra, Saviynt, directories, infrastructure, cloud control planes, SIEM/SOC, ITSM, and relevant DevOps/secrets tooling.
• Define PAM coverage, exception handling, platform hardening, resilience, controlled cutover, and evidence that standing privilege and unmanaged secrets are reduced.

IGA: Identity Lifecycle, Governance & Access Controls

• Lead Saviynt IGA solution architecture, configuration, integration, and rollout for identity aggregation, birthright access, and joiner-mover-leaver automation.
• Design access requests, policy-based approval processes, entitlement catalogues, role models, access reviews/certifications, segregation-of-duties controls, and exception processes.
• Integrate authoritative HR/student/affiliate data and application endpoints; define identity correlation, reconciliation, provisioning, deprovisioning, and orphan-account remediation.
• Ensure consistent governance of privileged entitlements with PAM, including account ownership, approval, attestation, revocation, and audit evidence.
• Partner with business and application owners to establish entitlement ownership, reviewer accountability, and risk-based certification scope.

Integrated Platform Implementation & Orchestration

• Translate target architecture into low-level designs, interface contracts, configuration baselines, delivery backlogs, test plans, and repeatable deployment patterns.
• Personally guide complex designs, prototypes, connector development, and troubleshooting while directing work by internal engineers, application teams, and implementation partners.
• Orchestrate interdependencies among Entra, Saviynt, PAM, HR, ITSM, directories, applications, cloud, SOC, and data owners; sequence technical releases to avoid control gaps.
• Drive end-to-end integration testing, security validation, migration and reconciliation testing, performance testing, defect remediation, and formal cutover criteria.
• Apply automation, infrastructure-as-code, and secure API practices where relevant; manage technical configuration and implementation evidence.

Identity Security, Resilience & Risk Reduction

• Embed least privilege, phishing-resistant authentication, policy enforcement, privileged access isolation, and continuous access evaluation where supported.
• Design auditability, logging, alerting, threat-detection integrations, and secure handling of identity secrets, tokens, keys, and sensitive identity data.
• Plan high availability, backup/recovery, emergency access, vendor dependencies, and disaster-recovery testing for critical identity services.
• Partner with Security Operations, GRC and IT to remediate identity risks, toxic entitlements, excessive permissions, dormant accounts, and failed lifecycle controls.

Technical Governance, Quality & Assurance

• Lead technical design reviews, standards compliance, architecture exceptions, threat modeling, and solution assurance across all IAM, PAM and IGA workstreams.
• Maintain solution blueprints, data mappings, interface specifications, configuration standards, build guides, design decisions, and technical risk/dependency logs.
• Provide evidence-based recommendations on platform fit, licensing, and design trade-offs; escalate material risks and unresolved decisions through approved governance.
• Set measurable acceptance criteria for connectivity, control efficacy, provisioning accuracy, performance, resilience, recoverability, and supportability.

Operating Model Design & Phased Service Transition

• Design the IAM/PAM/IGA target operating model with service definitions, RACI, control ownership, support tiers, runbooks, escalation, change, and incident processes.
• Build operational readiness into each release: design, build, test, deploy, stabilize, transition to named service owners, and optimize.
• Establish monitoring, service KPIs, access-control quality measures, operational acceptance criteria, training, and knowledge transfer.
• Lead technical hypercare and defect resolution while securing formal business-as-usual (BAU) acceptance; avoid indefinite dependence on the technical lead or vendors.

Cross-Functional Stakeholder Leadership

• Drive working-level technical alignment across Information Security, IT, HR, Academic Affairs, Research Computing, application owners, and external partners.
• Resolve source-of-truth conflicts, application readiness, ownership ambiguities, integration constraints, and access-policy implementation trade-offs.
• Present clear architecture options, risks, sequencing, and technical progress to the CISO, CIO, and relevant governance groups.
• Champion reliable identity user journeys while accommodating high-assurance access to sensitive research, critical infrastructure, and institutional systems.

Vendors, Delivery Partners & Engineering Capability

• Lead technical requirements, solution evaluation, proofs of concept, partner design reviews, and implementation acceptance for IAM, PAM, and IGA technologies.
• Hold system integrators and vendors accountable for design integrity, engineering quality, interoperability, documentation, and knowledge transfer.
• Mentor engineers and establish reusable design patterns, integration templates, configuration standards, and troubleshooting guidance.

Key Deliverables & Measurable Outcomes

• Approved integrated IAM–PAM–IGA target architecture, platform integration blueprint, security design principles, and phased technology roadmap.
• Build-ready low-level designs, identity data model, integration specifications, technical standards, migration plans, and documented architectural decisions.
• Implemented and tested Entra, Saviynt, and PAM technical capabilities with signed-off controls, production integrations, and formal release acceptance.
• Measurable progress in application onboarding, identity lifecycle automation, certification coverage, privileged-account coverage, credential rotation, and reduction of standing privilege.
• Established target operating model, service catalogue, operational KPIs, runbooks, training, hypercare records, and formally accepted BAU ownership.

Accountability, Decision Rights & Program Interfaces

• The Principal IAM Architect owns technical architecture, design integrity, engineering direction, integrated implementation assurance, and technical readiness for each transition.
• The IAM Program Manager owns integrated program planning, governance cadence, resources, cross-program dependencies, and consolidated reporting; both roles coordinate delivery sequencing.
• The CISO and relevant IT leaders approve major architecture exceptions, permanent organizational responsibilities, and service ownership through applicable governance.
• Named BAU teams assume ongoing service delivery after acceptance; the architect supports stabilization but is not the default permanent operations manager.

Competencies
Autonomy

• Serves as principal technical design authority within approved architecture, risk appetite, and delegated decision rights.
• Leads engineering priorities and implementation choices while escalating material strategic, commercial, or ownership decisions.

Influence

• Builds alignment among Information Security, IT, HR, Research, academic stakeholders, application owners, and delivery partners.
• Explains architecture, options, integration dependencies, and risk in terms understandable to both engineers and senior leaders.

Complexity

• Integrates heterogeneous identity populations and technologies across legacy, SaaS, hybrid, cloud, scientific, and highly privileged environments.
• Balances security outcomes, user experience, technical interoperability, engineering constraints, and iterative rollout risk.

Business Skills

• Demonstrates structured technical delivery leadership, vendor challenge, rigorous documentation, prioritization, and stakeholder decision-making.
• Develops internal engineering capability, operational sustainability, and measurable IAM/PAM/IGA control outcomes.

Qualifications
Essential

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Engineering, or related discipline.
• At least 10 years of relevant enterprise IT/security experience, including substantial hands-on IAM architecture and implementation leadership; proven ability to own complex multi-platform technical delivery.
• Demonstrated production delivery experience with Microsoft Entra and Saviynt IGA, including integration, provisioning, identity lifecycle, and access governance.
• Strong experience designing and implementing enterprise PAM controls using a leading platform (such as CyberArk, Delinea, BeyondTrust, or equivalent); product selection is not assumed.
• Deep knowledge of identity and federation standards: SAML, OAuth 2.0, OpenID Connect, SCIM, LDAP, APIs, certificates, FIDO2, PKI, and secure secrets handling.
• Ability to lead low-level solution design, cloud/on-premises identity integrations, identity data mapping, automation, migration, test assurance, and technical troubleshooting.
• Experience delivering privileged session controls, credential rotation, JIT elevation, account discovery, and service/machine identity governance.
• Proven experience coordinating multiple engineering teams, vendors, application owners, and IT/security operations through controlled production releases.
• Practical experience creating IAM operating models, technical runbooks, resilience controls, and phased operational transition.

Desirable

• Master’s degree; higher education or research environment experience; TOGAF/CISSP/CCSP or relevant Microsoft, Saviynt, and PAM vendor certifications.