Senior IAM Architect

Community Health System Services LLC•Buckland, MA

1d•$135,000 - $150,000•Remote

About The Position

The Senior IAM Architect is a senior technical lead responsible for designing, documenting, and advancing identity and access management capabilities across Xtensys and its customers. The role owns assessments of current IAM capabilities, defines future-state architecture, and develops practical steps to move between them. It requires independent judgment and initiative to identify and investigate process gaps, access anomalies, governance risks, and operational inefficiencies, document findings, and implement or recommend corrective actions. The Architect will optimize ManageEngine ADManager Plus for on-premises Active Directory and ManageEngine M365 Manager for Microsoft 365 and Entra ID environments. Work includes reducing manual lifecycle tasks, expanding workflow automation, improving governance controls, and developing enterprise RBAC and access certification capabilities. The role also partners with business stakeholders, HR, clinical operations, application owners, cybersecurity, and compliance teams to translate requirements into IAM workflows and controls. The position may mentor or provide technical direction to junior team members but has no formal supervisory responsibility. This is a remote role aligned with East Coast operational and collaboration hours. On-call support may be required approximately once every six weeks, and occasional travel of 5% or less may be required. The work is sedentary, involving sitting most of the time, with occasional walking and standing and exertion of up to 10 pounds of force occasionally.

Requirements

At least 8 years of hands-on IAM experience encompassing design, implementation, and operational ownership of enterprise identity systems.
Experience producing current-state assessments, IAM program roadmaps, and executive-facing communications for senior leadership.
Experience designing and managing Joiner, Mover, and Leaver workflows in complex multi-domain or post-merger environments.
Experience with Workday-to-Active Directory integration, including HR-driven provisioning, attribute mapping, and lifecycle synchronization.
Experience implementing or operating in healthcare or another regulated industry with HIPAA compliance obligations.
Deep expertise with Microsoft Active Directory and Microsoft Entra ID, including hybrid identity, Conditional Access, and delegated administration.
Strong PowerShell scripting skills for lifecycle automation, audit-log analysis, group-membership management, and reporting.
Proficiency with ManageEngine ADManager Plus, including role-based templates, delegated workflows, and provisioning automation.
Experience with ManageEngine M365 Manager, including license management, mailbox provisioning, and Microsoft 365 governance capabilities.
Experience with SAML, OAuth 2.0, OIDC, SCIM, and LDAP in enterprise integration contexts.
Working knowledge of Jira for service-ticket workflow management and IAM request routing.
Experience designing IAM programs in post-merger or multi-entity environments with multiple Active Directory domains and distinct identity namespaces.
Ability to work independently and proactively identify, investigate, document, and address IAM issues and opportunities.
Ability to provide on-call support approximately once every six weeks as needed.
Ability to travel occasionally, 5% or less, for team meetings and collaboration.
Ability to perform sedentary work, including sitting most of the time, occasional walking and standing, and occasional exertion of up to 10 pounds of force.

Nice To Haves

ManageEngine Certified Professional certification or equivalent IGA platform certification.
Microsoft Identity and Access Administrator (SC-300) certification or equivalent Entra ID certification.

Responsibilities

Monitor identity systems, access patterns, lifecycle workflows, and audit logs for anomalies, policy violations, and process gaps.
Investigate IAM anomalies, document root causes, and implement or recommend corrective actions with minimal direction.
Establish monitoring for stale accounts, orphaned access, offboarding compliance, and privilege creep.
Maintain a risk and improvement register and track identified items through resolution.
Assess, document, and baseline Joiner, Mover, Leaver, Leave of Absence, and Reactivation workflows across managed domains.
Document manual process steps, tooling gaps, compliance exposure, and quality-control risks.
Maintain IAM architecture diagrams, process flows, and system integration maps.
Design, implement, and optimize lifecycle workflows across Active Directory, Microsoft Entra ID, and integrated SaaS platforms.
Automate lifecycle processes in ManageEngine ADManager Plus through workflow automation, role-template optimization, and Jira integration improvements.
Improve integrations between Jira and Workday lifecycle event sources and ManageEngine ADManager Plus and M365 Manager, including event triggering, attribute mapping, and provisioning automation.
Partner with business stakeholders, HR, clinical operations, and application owners to gather requirements and configure IAM workflows.
Define and enforce offboarding standards, including cross-domain account disablement and privileged-account closure within established SLAs.
Optimize and expand ManageEngine ADManager Plus, including role-based templates, delegated workflows, provisioning automation, and Jira and Workday integrations.
Mature ManageEngine M365 Manager for Microsoft 365, Entra ID, lifecycle management, governance reporting, access controls, and Jira and Workday integrations.
Design and implement access certification campaigns, attestation workflows, and governance reporting independently in each platform.
Identify platform coverage gaps and develop a roadmap for expanding automation and governance capabilities.
Design and implement enterprise RBAC models across Active Directory and Entra ID.
Conduct and support periodic access reviews, recertifications, and audit evidence collection.
Develop and enforce IAM policies for account standards, naming conventions, attribute requirements, and lifecycle SLAs.
Partner with cybersecurity and compliance teams to align IAM controls with HIPAA, NIST 800-53, and organizational audit requirements.
Act as the senior technical escalation point for identity-related service tickets, provisioning failures, and access disputes.
Monitor IAM infrastructure performance, availability, and security anomalies, and proactively remediate issues.
Mentor or provide technical direction to junior IAM team members as needed.