Principal Security Architect, Identity Resilience

AvePoint•Chicago, IL

2d•$180,000 - $270,000

About The Position

The Principal Architect for Identity Security serves as the senior technical authority for security architecture across AvePoint’s identity resilience initiatives. The role focuses on securing, trusting, containing, recovering, and validating enterprise identity providers, identity control planes, privileged access systems, application identities, and hybrid identity environments before, during, and after disasters or identity compromises. Active Directory and Microsoft Entra ID are key platforms, but the remit extends beyond any single identity provider. The position is distinct from a platform-specific backup and recovery architect role. It owns the threat model, control-plane security, recovery trust model, incident-response integration points, secure restore guardrails, and post-recovery validation requirements needed to make identity resilience platforms trustworthy in adversarial conditions. The role translates deep identity security expertise into product architecture, security requirements, and customer-facing recovery guidance. This is a senior, hands-on identity security architecture role—not a generic IAM governance or pure SOC analyst position. The successful candidate understands identity as Tier-0 infrastructure, how attackers persist across identity systems, and how to design product workflows that help customers prepare, recover, and validate a trusted known-good state after a serious incident. The role partners across Product, Engineering, Architecture, Security, and Field teams, and engages with customers and partners to validate real-world security and recovery scenarios.

Requirements

Bachelor’s degree in Computer Science, Engineering, Information Systems, Cybersecurity, or a related technical field; equivalent practical experience is strongly considered.
12+ years of hands-on technical experience in identity infrastructure, cybersecurity architecture, incident response, or security engineering, with deep specialization in enterprise identity security.
Direct experience securing or recovering complex identity environments, including Active Directory, Microsoft Entra ID, hybrid identity, federation, trust relationships, privileged access boundaries, application identities, workload identities, and ransomware or destructive-attack readiness.
Deep understanding of Active Directory security internals, including Kerberos, NTLM, LDAP, ACLs and delegation, privileged groups, admin tiering, DCSync and replication rights, krbtgt rotation, golden and silver ticket risk, domain and forest trusts, SID history, SPNs, constrained, unconstrained, and resource-based constrained delegation, SYSVOL/GPO security, DNS, and AD CS/PKI risk.
Deep understanding of Entra ID security architecture, including Conditional Access, PIM, privileged roles, administrative units, authentication methods, Identity Protection, app registrations, enterprise applications, service principals, OAuth consent, workload identities, cross-tenant access, federation, and token/session behavior.
Strong understanding of hybrid identity security, including Entra Connect, Cloud Sync, password hash sync, pass-through authentication, AD FS/federation, sourceAnchor/ImmutableID, hard and soft match, source-of-authority conflicts, and the effects of on-premises compromise on Microsoft 365/Entra environments.
Hands-on experience with identity incident response and recovery workflows, including compromised-user containment, refresh-token/session revocation concepts, application/service-principal compromise response, API consent review, credential rotation, Conditional Access emergency response, and persistence removal.
Experience designing security architecture for high-privilege tools or platforms that operate against Tier-0 infrastructure, including secure credential handling, least privilege, separation of duties, audit logging, tamper resistance, approval workflows, and customer-managed key/storage models.
Familiarity with disaster recovery and business continuity requirements for identity systems, including RTO/RPO tradeoffs, known-good baselines, clean recovery environments, in-place versus clean-tenant recovery decisions, and post-restore validation.
Ability to translate complex security requirements into product requirements, architecture patterns, workflow guardrails, customer-facing warnings, and acceptance criteria that engineering teams can implement.
Strong customer-facing credibility with CISOs, identity architects, AD engineers, SOC/IR teams, compliance leaders, and executive stakeholders.
Demonstrated ability to lead without authority across Product, Engineering, Security, Architecture, Customer Success, Sales Engineering, and partner teams.

Nice To Haves

Experience working at or with vendors that build AD/Entra backup, recovery, ITDR, identity protection, or hybrid identity resilience products, such as Semperis, Quest, Cayosoft, Microsoft, Rubrik, Commvault, Veeam, CrowdStrike Identity, Mandiant, or equivalent.
Experience with Microsoft Defender for Identity, Microsoft Defender XDR, Microsoft Sentinel, Splunk, CrowdStrike, Semperis DSP, Quest, Cayosoft Guardian, or similar identity detection and response ecosystems.
Relevant certifications or recognition such as Microsoft Certified: Cybersecurity Architect Expert, Identity and Access Administrator, CISSP, GIAC, Microsoft MVP, or equivalent hands-on expertise.

Responsibilities

Own security architecture for AvePoint’s identity resilience platforms, including threat modeling, recovery trust criteria, privileged-access safeguards, secure restore guardrails, and post-recovery validation workflows across major enterprise identity providers.
Partner with platform backup and recovery architects to ensure identity restore, relationship recovery, policy recovery, and source-of-authority workflows operate safely under breach conditions.
Define the product’s Tier-0 security model, including least privilege, just-in-time elevation, credential isolation, gMSA usage, privileged access workstation expectations, break-glass handling, secure service accounts, immutable audit trails, and separation of monitoring and restore permissions.
Design security requirements for protecting the backup control plane, including administrator roles, service app and consented permissions, BYOS storage controls, network restrictions, key management, deletion approvals, retention tamper resistance, and recovery-data integrity validation.
Define support for pre-breach recovery readiness, including known-good state documentation, critical identity object inventory, break-glass validation guidance, restore permission validation, and out-of-band communications readiness.
Architect secure workflows for identity breach recovery, covering trusted control, detection and triage support, containment handoffs, persistence review, environment trust decisions, known-good restore, downstream workload recovery, and validation.
Translate identity attack and persistence patterns into product requirements, including malicious application registrations, service-principal credential abuse, illicit consent grants, access-policy tampering, privileged role assignment changes, risky federation or trust changes, guest-user persistence, and group membership abuse.
Define containment handoff requirements, including guidance or warnings around token and session revocation, password reset sequencing, service-principal credential rotation, app disablement, admin-consent review, and emergency Conditional Access controls.
Design safe Conditional Access recovery patterns, including dependency validation, break-glass account protection, policy state handling, restore-as-disabled or report-only options where supported, and approval checkpoints before re-enabling high-impact policies.
Design security requirements for application recovery, including generated app secrets, new key IDs, API permission re-consent, Enterprise Application permission caveats, SSO and provisioning validation, credential rotation workflows, and secure reporting of secrets or remediation tasks.
Define how the product compares current state against known-good backups without overclaiming detection, including post-recovery-point objects, changed privileged assignments, changed app credentials, modified Conditional Access policies, changed Named Locations, and changed memberships.
Own the post-restore security validation model, including critical object, privileged access, app/service-principal, Conditional Access dependency, and break-glass access validation; manual remediation checklists; and evidence and reporting for security, audit, and compliance teams.
Provide specialized recovery security guidance for Active Directory topics such as forest and domain trust risk, domain controller trust boundaries, krbtgt and privileged credential handling, AD CS and certificate abuse, SYSVOL/GPO integrity, DNS trust assumptions, and safe forest recovery sequencing.
Partner with Product, Engineering, Architecture, Security, and Field teams to turn security and recovery requirements into epics, design reviews, acceptance criteria, test plans, and customer-facing recovery guidance.
Conduct customer and field discovery with CISOs, incident responders, AD architects, Entra ID administrators, identity security teams, MSPs, and regulated or government customers.
Track competitor and market patterns across identity-resilience and ITDR vendors, emphasizing security and recovery workflows rather than generic feature comparisons.
Mentor engineering and product teams on AD and Entra security concepts, identity attack paths, recovery safety principles, and security-first workflows for Tier-0 infrastructure.