Identity & Access Management Architect

Position title

Identity Access Management Architect

Description

The Identity & Access Management (IAM) Architect is a senior technical role responsible for designing, implementing and governing enterprise identity architecture across Microsoft Entra ID (Azure AD), on-premises Active Directory, Microsoft 365 and federated SaaS identity providers. The role owns authentication, authorisation, privileged access and the full identity lifecycle - ensuring secure, consistent and auditable access across the organisation.

Responsibilities

• The role combines deep architectural expertise in Entra ID / Active Directory, SSO, conditional access and privileged access management with strong operating discipline across Microsoft 365 governance, endpoint identity, compliance rules and SaaS identity integrations.
• The ideal candidate is equally comfortable designing JML (joiner-mover-leaver) automation, authoring conditional access and transport / DLP policies, operating PIM / PAM and partnering with Security, HR and Business stakeholders to enforce least-privilege and zero-standing-privilege models.

Qualifications

• Minimum 8-10 years of hands-on IT experience, with at least 5 years in a dedicated Identity & Access Management or Microsoft 365 governance role in an enterprise
• Proven, deep expertise in Microsoft Entra ID (Azure AD), on-premises Active Directory and hybrid identity (Entra Connect, federation).environment.
• Demonstrable experience designing and operating Conditional Access, MFA, SSO, SCIM provisioning and RBAC / ABAC authorisation models at scale.
• Hands-on experience with Microsoft 365 governance - transport / DLP / retention rule management, sensitivity labels, eDiscovery and tenant-wide policy.
• Strong track record implementing Privileged Access Management (PAM / PIM), just-in-time access and privileged-session controls.
• Experience automating JML and access-review processes using PowerShell, Microsoft Graph API or an IGA platform.
• Experience managing endpoints and endpoint-identity through Intune / Autopilot / SCCM in a Zero Trust context.
• Experience supporting client audits, ISO / ISMS reviews and privileged-access documentation.