Job Description

Title: IAM Architect Location: Weston, Florida (3 days onsite, hybrid) Duration: Long-term contract Role Summary: The Client is seeking a senior Identity and Access Management Architect to assess, modernize, and improve its user provisioning environment. The architect will design secure, scalable, and reliable identity lifecycle processes across Workday, Banner, Active Directory, Microsoft Entra ID, OneLogin, and downstream applications. The role requires strong hands-on provisioning expertise to establish authoritative identity sources, automate joiner/mover/leaver processes, support employee and student identities, including dual affiliations, and implement monitoring, reconciliation, error handling, and deprovisioning safeguards. The architect will define the target-state IAM architecture, create a phased modernization roadmap, and guide implementation according to modern IAM, security, governance, and least-privilege practices. Job Description: 8+ years of enterprise IAM experience, with significant responsibility for identity architecture and user-provisioning design. Proven ability to assess an existing provisioning environment and design a modern, scalable target-state architecture. Expert knowledge of end-to-end user provisioning across HR/SIS systems, identity platforms, directories, and downstream applications. Experience designing joiner, mover, leaver, rehire, return, and deprovisioning processes. Experience handling complex identity scenarios, including employee/student dual affiliations, duplicate identities, role changes, and multiple source records. Experience establishing authoritative identity sources and ownership rules for critical identity attributes. Strong experience integrating Workday, Banner, or comparable HRIS, SIS, and ERP platforms with IAM systems. Expert knowledge of Microsoft Entra ID, Active Directory, Entra Connect, Cloud Sync, and cross-tenant synchronization. Experience designing automated provisioning using SCIM, APIs, Microsoft Graph, PowerShell, SQL, file-based integrations, and middleware. Experience implementing provisioning safeguards, including reconciliation, validation, approval gates, retry processing, error handling, rollback, and mass-deletion protection. Ability to design monitoring and alerting for failed provisioning, synchronization issues, duplicate identifiers, stale accounts, and incomplete lifecycle events. Experience defining modern access-assignment models using roles, groups, attributes, access packages, and least-privilege principles. Strong understanding of authentication, provisioning, authorization, and identity governance as separate but connected functions. Expertise with SAML, OIDC/OAuth, SCIM, LDAP, and Kerberos. Experience modernizing legacy IAM platforms, custom scripts, databases, manual workflows, and duplicated provisioning logic. Ability to define the appropriate long-term roles of on-premises AD, Entra ID, multiple tenants, and legacy identity platforms. Experience designing identity governance, access reviews, privileged access, service-account governance, and timely access removal. Ability to create current-state and target-state architecture, identity-flow diagrams, source-of-authority matrices, attribute mappings, and lifecycle standards. Ability to produce a prioritized, phased modernization roadmap that can be realistically implemented without disrupting production. Hands-on technical ability to review configurations and code, analyze identity data, troubleshoot provisioning failures, lead proofs of concept, and guide implementation. Strong communication and knowledge-transfer skills for working with technical teams, business owners, leadership, and vendors.