Workforce Identity Architect, VP

MUFG•Jersey City, NJ

7d•$166,000 - $192,000•Hybrid

About The Position

The Workforce Identity Architect is a senior architecture role responsible for defining and governing workforce (human) identity architecture at global scale. The role designs and standardizes how employee and partner identities are created, governed, authenticated, authorized, reviewed, and retired across hybrid and cloud environments. It operationalizes global IAM standards for human identity, supporting secure, scalable, and auditable access as regions progress through different identity maturity stages. The position focuses on architecture, standards, and enablement—not day-to-day operations or tool administration. The architect establishes global workforce identity standards using Microsoft Entra ID, including hybrid and cloud-mastered environments; identity lifecycle and governance models; workforce privileged access; external and partner identity patterns; and metrics-based continuous improvement. The role bridges architecture, security, risk, and delivery teams, and helps regions adopt consistent identity practices while reducing access risk and certification fatigue.

Requirements

8–10+ years of experience in identity, access management, or security architecture roles.
Deep expertise in Microsoft Entra ID architecture in hybrid environments.
Enterprise-level experience designing workforce identity architecture at scale.
Strong understanding and experience designing Joiner / Mover / Leaver (JML) lifecycle patterns and HR-driven identity provisioning.
Strong grounding in least privilege, access lifecycle management, and identity hygiene.
Architectural experience designing authentication, federation, Conditional Access, MFA, tenant-level architecture, and integration patterns.
Proven experience designing identity governance solutions, including access reviews or certifications, separation of duties, and access request and approval workflows.
Experience with privileged access for workforce identities, including Privileged Identity Management (PIM) and Just-in-Time (JIT) access concepts.
Ability to design auditable, regulator-defensible access models.
Proven ability to influence and collaborate across technical and non-technical stakeholders, including architecture, engineering, security, risk, and audit teams.
Ability to translate complex identity concepts into clear architectural standards.
Bachelor's degree in Computer Science or a closely related discipline, or an equivalent combination of formal education and experience.

Nice To Haves

Experience using analytics or AI-assisted tools to improve role and entitlement rationalization, role or bundle design, and access certification.
Ability to translate analytic insights into architectural improvements.
Experience supporting global or federated IAM models with regional variation and varying maturity levels.
Familiarity with phased migrations from on-premises AD-centric to cloud-mastered identity.
Experience designing B2B or partner identity patterns using Entra ID and secure external collaboration models that preserve centralized governance.
Experience defining or consuming IAM metrics such as access review effectiveness, orphaned or dormant access, and role reuse versus sprawl.
Familiarity with continuous access evaluation, signal-driven identity models, workforce identity data platforms, or identity fabric concepts.
Understanding of how workforce identity integrates with cloud platforms such as AWS IAM Identity Center, without owning cloud IAM design.
Relevant certifications, such as Microsoft Identity, CISSP, CCSP, or IAM-focused certifications.
Experience in financial services or other highly regulated industries.

Responsibilities

Define and maintain global workforce identity architecture using Microsoft Entra ID in hybrid and cloud-mastered environments.
Establish standard patterns for authentication, federation, Conditional Access, and MFA.
Design tenant-level identity integration patterns that scale across applications and regions.
Architect and standardize Joiner / Mover / Leaver (JML) identity lifecycle patterns driven by authoritative HR sources.
Ensure consistent provisioning, modification, and deprovisioning of workforce identities.
Reduce orphaned, dormant, and over-provisioned access through strong lifecycle design.
Define workforce identity governance standards, including access requests, access reviews, and separation of duties (SoD).
Architect privileged access models for workforce identities, including PIM and Just-in-Time access.
Ensure access models are auditable and aligned to regulatory and risk expectations.
Use analytics and AI-assisted capabilities to improve role and entitlement design and reduce access certification noise.
Translate analytic insights into architectural improvements rather than one-off reporting.
Define B2B and partner identity patterns using Entra ID that enable collaboration while maintaining centralized governance.
Ensure third-party access aligns with global standards and workforce identity controls.
Partner with IAM Governance teams to define and use workforce identity metrics, including access quality, review effectiveness, and lifecycle hygiene.
Use metrics to continuously improve identity architecture and reduce access risk.
Collaborate across architecture, engineering, security, risk, and audit teams; influence outcomes without direct authority.
Translate complex identity concepts into clear architectural standards.