identity Architect

Identity Architect (Domain Lead) Leads 2-3 engineers. No travel. Designs and delivers the move of each acquired company’s directories, tenants and access model onto the parent’s Entra ID / M365 standard, while keeping users in both environments signing in and working until final cutover.

• Discover and map the acquired identity estate: AD forests and domains, tenants, federation, privileged accounts
• Design the target identity model, cross-tenant coexistence and the order of UPN and domain moves
• Plan the impact on SSO applications, devices and non-human identities (service accounts, service principals), and set the migration sequence
• Re-point SSO applications (SAML, OIDC, SCIM) and migrate non-human identities with least privilege
• Implement SOX access controls with the compliance team and retire the source environment at closeout
• Hands-on: configuration, scripting and cutover execution

Must have: [8+] years of identity and access management, with design ownership on cross-tenant migrations; deep Entra ID (Conditional Access, SSO, MFA, Entra Connect) and Active Directory; SAML/OIDC/OAuth/SCIM and claims mapping; PowerShell, Python and Graph; DNS and PKI. Nice to have: SC-300, Quest or similar migration tooling, AWS/Google Cloud Platform/OCI identity.