Infrastructure Security and IAM Architect

Role Summary

Designs the identity, access and infrastructure security architecture for a carve-out, covering the hybrid domain controller and Entra ID estate. Owns the target-state design and the technical approach for moving users, mailboxes and collaboration content. Re-architects only where the separation requires it.

Job Responsibilities

• Design the target identity architecture across on-premises Active Directory and Microsoft Entra ID
  

• Define SSO, MFA, Conditional Access and privileged access models
  

• Design directory synchronisation using Microsoft Entra Connect and tenant coexistence
  

• Architect application sign-in and federation using SAML, OAuth 2.0 and OpenID Connect
  

• Design network access authentication using RADIUS and 802.1X
  

• Define infrastructure security controls: segmentation, firewalls, key and secrets management
  

• Design landing zone security controls and guardrails across Azure and AWS
  

• Select and configure migration tooling for user, mailbox, SharePoint and Teams moves
  

• Produce high-level and low-level designs and review them with client architects
  

• Define security logging requirements for identity and infrastructure events
  

Required Experience

• 10+ years of relevant experience in infrastructure and security architecture
  

• 5+ years designing and implementing identity, including on-premises domain controller clusters
  

• Strong understanding of Active Directory, Kerberos, LDAP and DNS
  

• Strong understanding of Microsoft Entra ID and Entra Connect version 2 or above, including Entra Domain Services
  

• Hands-on experience with SSO, MFA and Conditional Access
  

• Experience with at least one third-party identity provider such as Okta or Ping Identity
  

• 3+ years of experience with SAML and OAuth 2.0, plus OpenID Connect
  

• Understanding of RADIUS-based authentication and 802.1X
  

• Experience with migration tools such as BitTitan, Quest and AvePoint
  

• Experience with mailbox, SharePoint, Teams and user migration
  

• Experience with at least two cloud providers (Azure and AWS)
  

• Experience designing and implementing landing zones with security controls and guardrails
  

• Experience with Azure Key Vault or equivalent key management services
  

• Experience designing colocation architectures
  

• Deep understanding of hyper-converged infrastructure
  

• Exposure to at least two OEMs or two cloud providers in each technology area
  

• Strong communication skills, with prior experience working with UK and EU clients
  

• Willingness to travel as required and to work in the client time zone
  

• Prior infrastructure background alongside the specialism above
  

• Prior experience in IT consolidations, mergers, demergers and carve-outs (mandatory)
  

• Relevant professional certifications strongly recommended