Associate Director, Identity & Access Management Architect

Alnylam Pharmaceuticals•Cambridge, MA

2h•$176,800 - $239,200•Hybrid

About The Position

Alnylam is seeking an Associate Director, Identity & Access Management Architect to lead the architecture, engineering, and delivery of identity services across the enterprise. The role brings together identity governance and administration (IGA), privileged access management (PAM), authentication, directory services, cloud identity, and non-human identities to support secure access for people, applications, and technology. Reporting to the Senior Director, Head of Identity and Access Management, this leader owns IAM architecture and engineering and provides technical ownership of IGA, PAM, Active Directory, Microsoft Entra ID, and hybrid identity. The role combines strategic direction with hands-on technical execution, partnering with engineering, infrastructure, and business teams to design, modernize, troubleshoot, and operate resilient identity capabilities. This is a hybrid role primarily based in Cambridge, Massachusetts, with up to 25% local and international travel. The role is eligible for annual short-term and long-term incentive awards. The stated U.S. base salary range is $176,800–$239,200.

Requirements

Bachelor’s degree in computer science, cybersecurity, engineering, or a related field, or equivalent experience.
At least 8 years of progressive experience in IAM, identity engineering, Directory Services, or related technology disciplines, including at least 5 years in architecture, engineering, or technical delivery roles designing and implementing complex identity solutions.
Experience delivering enterprise IAM solutions across IGA, PAM, access management, Active Directory, Entra ID, and hybrid or cloud identity.
Deep hands-on AD and Entra ID expertise, including directory architecture, synchronization, authentication, Conditional Access, privileged roles, security hardening, and troubleshooting.
Experience with SailPoint and BeyondTrust or CyberArk, and with SAML, OAuth 2.0, OIDC, SCIM, Kerberos, LDAP/LDAPS, REST APIs, and certificates.
Ability to script, automate, and review technical solutions using PowerShell, Microsoft Graph, REST APIs, and at least one of Python, JavaScript, or infrastructure-as-code tools.
Ability to turn architecture into working solutions, lead technical reviews, guide engineers, and communicate decisions to business and technology leaders.
Strong familiarity with cybersecurity frameworks and standards, such as NIST CSF, NIST 800-53, and Zero Trust Architecture concepts.
Demonstrated ability to influence senior stakeholders and drive adoption of modernized IAM concepts, processes, and technology decisions across complex, regulated environments.
Excellent communication skills, including translating complex technical concepts into clear business impact.

Nice To Haves

Experience in a regulated environment.
Certifications such as CISSP, Microsoft identity, SailPoint, BeyondTrust, or CyberArk.

Responsibilities

Define and own enterprise IAM target architecture, technical standards, integration patterns, and roadmaps across IGA, PAM, access management, directory services, cloud, and non-human identity.
Lead identity solution design and engineering from architecture review and proof of concept through implementation, testing, operational handoff, and ongoing improvement.
Own the technical direction of Active Directory, Entra ID, and hybrid identity, including tenant and directory architecture, synchronization, authentication, groups, privileged administration, and service resilience.
Drive directory modernization and security, including legacy authentication reduction, Tier 0 protection, hardening, recovery, and complex migration or incident support.
Architect, design, implement, and roll out identity lifecycle and governance capabilities, including joiner, mover, and leaver processes; automated provisioning; birthright access; role models; access reviews; and application onboarding through SailPoint and related integrations.
Define PAM architecture for privileged account discovery, credential vaulting and rotation, session controls, just-in-time access, emergency access, and integration with directory and governance platforms.
Establish access management standards for SSO, MFA, phishing-resistant and passwordless authentication, federation, and Conditional Access using appropriate modern protocols.
Define secure identity patterns for cloud workloads, service accounts, service principals, secrets, certificates, APIs, and AI agents, including ownership, least privilege, and lifecycle controls.
Partner with Cybersecurity, Infrastructure, Cloud, Applications, Data and AI, and Enterprise Architecture to address identity risk, strengthen detection and response, and embed Zero Trust principles.
Drive automation and reusable engineering practices; mentor IAM and directory engineers; and serve as a technical escalation point for complex identity issues.