Identity Security Architect

• Define and deliver enterprise Identity & Access Management (IAM) architecture, primarily leveraging Microsoft Entra ID across cloud, hybrid and on-premises environments.
• Design secure authentication, authorisation and identity governance solutions for users, administrators, applications, workloads and external identities.
• Develop identity roadmaps, architecture standards, security patterns and technical governance frameworks.
• Architect and optimise Microsoft Entra capabilities including Conditional Access, ID Protection, PIM, Identity Governance, External ID, Access Reviews, Entitlement Management and Hybrid Identity solutions.
• Design hybrid identity integrations between Active Directory and Microsoft Entra ID, including strategies for passwordless and phishing-resistant authentication (FIDO2, Windows Hello for Business, Microsoft Authenticator and certificate-based authentication).
• Implement Zero Trust identity architectures, enforcing least privilege, risk-based access controls and secure administrative access models.
• Define privileged access strategies using Entra PIM, RBAC/ABAC, Just-in-Time (JIT) access and privileged account governance.
• Lead identity governance initiatives, including Joiner-Mover-Leaver (JML) processes, access certification, lifecycle automation and management of guest/external identities.
• Provide architectural guidance for application and workload identities, including OAuth 2.0, OpenID Connect, SAML, Enterprise Applications, App Registrations, Managed Identities and Service Principals.
• Establish governance for application permissions, secrets, certificates and workload credentials, reducing reliance on long-lived credentials.
• Ensure identity services integrate effectively with the wider Microsoft security ecosystem, including Defender, Sentinel, Intune, Purview and Azure security services.
• Conduct identity assessments, identify security and operational improvements, and mitigate risks related to privileged access, credential exposure and legacy authentication.
• Lead stakeholder workshops, translate business and security requirements into technical solutions, and produce architecture documentation, standards and migration roadmaps.
• Provide technical leadership, design assurance and governance support throughout project delivery, implementation and solution lifecycle.

• Significant experience designing enterprise Identity and Access Management solutions.
• Strong architecture-level expertise with Microsoft Entra ID and Microsoft identity technologies.
• Strong understanding of Active Directory and hybrid identity architectures.
• Demonstrable experience designing Conditional Access strategies at enterprise scale.
• Strong knowledge of privileged access management and Microsoft Entra PIM.
• Experience with identity governance, lifecycle management and access certification.
• Strong understanding of modern authentication and federation protocols including OAuth 2.0, OpenID Connect, SAML and Kerberos.
• Experience designing passwordless and phishing-resistant authentication solutions.
• Strong understanding of Microsoft 365 and Azure security architecture.
• Experience designing identity controls as part of a Zero Trust security architecture.
• Ability to assess identity security posture and translate findings into prioritised remediation programmes.
• Experience operating in complex enterprise environments with multiple business units, applications and stakeholder groups.

The role can be offered as either a day rate contract between c£450-£550 per day inside IR35 on an umbrella solution or as a fixed term contract with a salary of £80-90k.