Principal IAM/PAM Security Architect

Cotiviti•Remote,

1d•$160,000 - $190,000•Remote

About The Position

The Principal IAM/PAM Security Architect defines and evolves security architecture for identity and privileged access across a large, complex, multi-domain environment spanning Active Directory, Microsoft Entra ID, and Okta, as well as cloud-native identities across AWS, Azure, GCP, and OCI. This role sets security standards for each identity environment, leads the definition of emerging Agentic Identity standards for AI agents and other non-human identities, defines requirements for and drives implementation of the Delinea PAM platform, and owns secrets governance enterprise-wide — including API keys, OAuth/OATH tokens, service account credentials, and certificates. The architect partners closely with identity, cloud, and application teams to keep controls consistent, auditable, and scalable.

Requirements

Bachelor’s degree in a technology discipline or equivalent professional experience.
8+ years of experience in identity and access management, privileged access management, or security architecture roles, including experience across large, complex enterprise environments.
Demonstrated experience designing security standards across hybrid identity environments (Active Directory, cloud IAM, and SaaS identity providers).
Hands-on experience with a PAM platform (Delinea preferred) at an architecture or lead engineering level.
Enterprise Identity Platforms: Active Directory (multi-domain/forest architectures), Microsoft Entra ID, and Okta, including federation, conditional access, and hybrid identity synchronization.
Cloud IAM: Identity and access models across AWS, Azure, GCP, and OCI, including IAM roles/policies, workload identity, federation, and cross-cloud access patterns.
Agentic & Non-Human Identity: AI agent architectures, service/workload identities, and emerging standards for non-human identity governance.
Delinea PAM & Secrets Management: Hands-on experience with Secret Server and Privilege Manager, plus broader vaulting technologies (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager) and secrets-detection tooling.
Authentication & Authorization Protocols: Kerberos/NTLM, LDAP/LDAPS, SAML/OIDC, OAuth 2.0, RADIUS/TACACS+, PKI/certificates, and MFA.
Security & Compliance Frameworks: SOX, HIPAA, PCI DSS, and ISO 27001 as applied to identity, privileged access, and secrets controls.
Automation & DevOps Integration: PowerShell, Python, and REST APIs for identity/PAM/secrets lifecycle automation; experience embedding these controls into CI/CD pipelines and infrastructure-as-code (Terraform, ARM, CloudFormation).
Strong analytical and architectural problem-solving skills, with the ability to translate complex, multi-domain identity environments into clear standards and communicate architecture and risk decisions to technical and business stakeholders.
Must be able to provide high-speed internet access / connectivity and office setup and maintenance.
Must be able to provide a dedicated, secure work area.

Nice To Haves

Relevant security certifications preferred (e.g., CISSP, CISM, SABSA, CCSP).

Responsibilities

Define and maintain security architecture and standards across Active Directory, Microsoft Entra ID, Okta, and multi-cloud identity (AWS, Azure, GCP, OCI), covering authentication, authorization, and lifecycle controls.
Serve as the architectural authority for identity security decisions, aligning platform and cloud teams to enterprise standards across a large, complex identity environment.
Lead architecture reviews and risk assessments for new identity integrations, platform migrations, and M&A activity.
Define enterprise standards for Agentic Identity — governance, lifecycle, authentication, and authorization for AI agents and other non-human identities, including provisioning, scoped entitlements, and deprovisioning.
Track the evolving agentic AI and non-human identity landscape and advise leadership on emerging risks, standards, and vendor capabilities.
Define security requirements for and lead enterprise-wide implementation of the Delinea PAM platform (Secret Server, Privilege Manager).
Design privileged access controls — least privilege, JIT/JEA, session monitoring, credential rotation — across on-premises and cloud environments, and oversee onboarding of privileged accounts and systems.
Produce audit-ready evidence of PAM controls aligned to frameworks such as SOX, HIPAA, PCI, and ISO 27001.
Own enterprise policy and lifecycle standards for all secrets — API keys, OAuth/OATH tokens, service account credentials, and certificates — including vaulting, rotation, and secure distribution.
Drive detection and remediation of hardcoded, unmanaged, or leaked secrets across source code, configuration, and CI/CD pipelines.
Establish metrics and reporting to track secrets governance maturity and compliance across the organization.
Participate in and help lead architecture review boards, governance forums, and risk committees for identity and privileged access.
Maintain reference architectures, standards documentation, and roadmaps for identity, PAM, and secrets governance.
Advise stakeholders on identity risk and control design for new initiatives, and mentor engineers implementing identity, PAM, and secrets solutions.
Complete all responsibilities as outlined in the annual performance review and/or goal setting.
Complete all special projects and other duties as assigned.
Must be able to perform duties with or without reasonable accommodation.
This job description is intended to describe the general nature and level of work being performed and is not to be construed as an exhaustive list of responsibilities, duties and skills required.
This job description does not constitute an employment agreement and is subject to change as the needs of Cotiviti and requirements of the job change.