Sr IAM Architect

3Core Systems , Inc•Weston, Florida, FL

1d•Hybrid

About The Position

The Client is seeking a senior Identity and Access Management Architect to assess, modernize, and improve its user-provisioning environment. The architect will design secure, scalable, and reliable identity lifecycle processes across Workday, Banner, Active Directory, Microsoft Entra ID, OneLogin, and downstream applications. The role requires hands-on provisioning expertise to establish authoritative identity sources; automate joiner, mover, and leaver processes; support employee and student identities, including dual affiliations; and implement monitoring, reconciliation, error handling, and deprovisioning safeguards. The architect will define the target-state IAM architecture, create a phased modernization roadmap, and guide implementation in accordance with modern IAM, security, governance, and least-privilege practices. The position is a long-term contract based in Weston, Florida, with three days onsite and a hybrid work arrangement.

Requirements

At least 8 years of enterprise IAM experience, with significant responsibility for identity architecture and user-provisioning design.
Proven ability to assess an existing provisioning environment and design a modern, scalable target-state architecture.
Expert knowledge of end-to-end user provisioning across HR/SIS systems, identity platforms, directories, and downstream applications.
Experience designing joiner, mover, leaver, rehire, return, and deprovisioning processes.
Experience handling employee/student dual affiliations, duplicate identities, role changes, and multiple source records.
Experience establishing authoritative identity sources and ownership rules for critical identity attributes.
Strong experience integrating Workday, Banner, or comparable HRIS, SIS, and ERP platforms with IAM systems.
Expert knowledge of Microsoft Entra ID, Active Directory, Entra Connect, Cloud Sync, and cross-tenant synchronization.
Experience designing automated provisioning using SCIM, APIs, Microsoft Graph, PowerShell, SQL, file-based integrations, and middleware.
Experience implementing provisioning safeguards, including reconciliation, validation, approval gates, retry processing, error handling, rollback, and mass-deletion protection.
Ability to design monitoring and alerting for failed provisioning, synchronization issues, duplicate identifiers, stale accounts, and incomplete lifecycle events.
Experience defining access-assignment models using roles, groups, attributes, access packages, and least-privilege principles.
Strong understanding of authentication, provisioning, authorization, and identity governance as separate but connected functions.
Expertise with SAML, OIDC/OAuth, SCIM, LDAP, and Kerberos.
Experience modernizing legacy IAM platforms, custom scripts, databases, manual workflows, and duplicated provisioning logic.
Ability to define the appropriate long-term roles of on-premises AD, Entra ID, multiple tenants, and legacy identity platforms.
Experience designing identity governance, access reviews, privileged access, service-account governance, and timely access removal.
Ability to create current-state and target-state architecture, identity-flow diagrams, source-of-authority matrices, attribute mappings, and lifecycle standards.
Ability to produce a prioritized, phased modernization roadmap that can be realistically implemented without disrupting production.
Hands-on technical ability to review configurations and code, analyze identity data, troubleshoot provisioning failures, lead proofs of concept, and guide implementation.
Strong communication and knowledge-transfer skills for working with technical teams, business owners, leadership, and vendors.

Responsibilities

Assess the existing user-provisioning environment and design a modern, scalable target-state IAM architecture.
Design end-to-end identity provisioning across HR/SIS systems, identity platforms, directories, and downstream applications.
Design joiner, mover, leaver, rehire, return, and deprovisioning processes, including complex employee/student dual affiliations and duplicate identities.
Establish authoritative identity sources and ownership rules for critical identity attributes.
Design integrations between HRIS, SIS, and ERP platforms and IAM systems.
Design automated provisioning using SCIM, APIs, Microsoft Graph, PowerShell, SQL, file-based integrations, and middleware.
Implement provisioning safeguards such as reconciliation, validation, approval gates, retry processing, error handling, rollback, and mass-deletion protection.
Design monitoring and alerting for failed provisioning, synchronization issues, duplicate identifiers, stale accounts, and incomplete lifecycle events.
Define modern access-assignment models using roles, groups, attributes, and access packages, applying least-privilege principles.
Define the long-term roles of on-premises Active Directory, Entra ID, multiple tenants, and legacy identity platforms.
Design identity governance, access reviews, privileged access, service-account governance, and timely access removal.
Create current-state and target-state architecture, identity-flow diagrams, source-of-authority matrices, attribute mappings, and lifecycle standards.
Produce a prioritized, phased modernization roadmap that can be implemented without disrupting production.
Review configurations and code, analyze identity data, troubleshoot provisioning failures, lead proofs of concept, and guide implementation.
Work with technical teams, business owners, leadership, and vendors; provide communication and knowledge transfer.