IAM Security Architect

Experis - ManpowerGroup; Greater London; On-site; GBP 71,217 - 118,818; Full time

Job summary

Experis - ManpowerGroup is seeking an IAM Security Architect to lead enterprise identity and access management across Azure Entra ID, GCP, and cloud SaaS platforms. The role emphasizes federation, token governance, and a Zero Trust security model in a hybrid cloud environment.

The successful candidate will design and govern secure identity patterns for users, applications, workloads, and APIs, while providing technical leadership for authentication, authorization, and secrets management across

Qualifications

• Extensive IAM design experience across multi-cloud environments.
• Experience with Azure Entra ID and Google Cloud IAM.
• Strong understanding of Zero Trust principles and cloud security best practices.
• Experience integrating IAM with SaaS providers and API security.

Responsibilities

• Define and maintain the IAM strategy and roadmap across clouds.
• Design secure identity architectures for human and machine workloads.
• Implement SSO, MFA, and passwordless authentication.
• Govern token lifecycle management and secret management processes.
• Lead cross-cloud federation and API authentication architectures.

Skills

IAM Architecture

Azure Entra ID

GCP

Zero Trust

SSO & MFA

Token management

Tools

Azure Key Vault

Entra Workload Identities

Secret Manager

Cloud KMS

Job description

Role Title: IAM Security Architect

Duration: contract to run until 26/02/2027

Location: London/Brighton/Staines. Hybrid working 3 days per week onsite

Rate: up to £644 p/d Umbrella inside IR35

Role purpose / summary

The Identity & Access Architect is responsible for defining, designing, and governing enterprise-wide Identity and Access Management (IAM) solutions across Microsoft Azure, Microsoft Entra ID, Google Cloud Platform (GCP) and Saas Platform such as Salesforce, Oracle Health Insurance , and PeopleSoft

The role provides technical leadership for identity architecture, authentication, authorization, privileged access management, federation, secrets management, token lifecycle governance, and DevSecOps identity controls. The architect will establish secure, scalable, and compliant identity patterns for users, applications, workloads, APIs, automation platforms, and CI/CD pipelines while supporting a Zero Trust security model.

The successful candidate will serve as the subject matter expert for cloud identity, access governance, workload authentication, and token management across hybrid and multi-cloud environments for human and also agentic access requirements.

Key Responsibilities

Identity Architecture & Strategy

• Define and maintain the enterprise IAM strategy and roadmap.
• Design secure identity architectures across Azure, Entra ID, GCP , SaaS platform
• Design User access management for human, Agentic applications and API's
• Develop identity governance standards, patterns, and reference architectures.
• Ensure alignment with Zero Trust principles and cloud security best practices.
• Lead the design of hybrid identity and cloud-native authentication solutions.
• Provide architecture guidance for new applications, platforms, and services.

Authentication & Federation

Design and implement enterprise authentication and federation services including:

• Single Sign-On (SSO)
• Multi-Factor Authentication (MFA)
• Passwordless Authentication
• Federation Services
• Identity Trust Relationships

Protocols and technologies

• SAML 2.0
• OAuth 2.0
• OpenID Connect (OIDC)
• SCIM
• WS-Federation
• Kerberos
• LDAP

Responsibilities include

• Federation between Microsoft Entra ID and GCP.
• Integration with SaaS and third-party identity providers.
• B2B and B2C identity solutions.
• Cross-cloud trust establishment.
• API authentication architecture.

Token Management & Governance

Act as the enterprise authority for token lifecycle management.

Token Types:

• OAuth Access Tokens
• Refresh Tokens
• ID Tokens
• JWT Tokens
• Service Account Tokens
• OIDC Tokens
• PAT (Personal Access Tokens)
• API Access Tokens

Responsibilities

• Define token issuance standards.
• Establish token lifespan and expiry policies.
• Design token validation mechanisms.
• Define token revocation processes.
• Implement token monitoring and auditing.
• Govern token signing and certificate management.
• Design secure token storage patterns.
• Prevent token leakage and abuse.
• Establish short-lived token standards across cloud platforms.

Security Principles

• Least privilege access
• Just-In-Time (JIT) authentication
• Zero Trust verification
• Secure token handling
• Continuous validation of identity

Secrets, Certificates & Key Management

Design and govern enterprise secret management capabilities.

Microsoft Azure

• Azure Key Vault
• Managed Identities
• Entra Workload Identities
• Service Principals
• Certificate Management

Google Cloud Platform

• Secret Manager
• Cloud KMS
• Customer Managed Encryption Keys (CMEK)
• Workload Identity Federation
• Service Accounts

Responsibilities

• Credential lifecycle management.
• Automated secret rotation.
• Certificate lifecycle governance.
• Encryption key management.
• Elimination of hard-coded credentials.
• Secure storage and retrieval controls.
• Auditable access to sensitive credentials.
• Secrets management standards across cloud platforms.

Privileged Access Management (PAM)

Design and govern privileged access solutions including:

• Microsoft Entra Privileged Identity Management (PIM)
• Just-In-Time Access
• Just Enough Administration (JEA)
• Google Cloud IAM Controls

Responsibilities include

• Privileged role governance.
• Privileged access reviews.
• Break-glass account management.
• Segregation of duties controls.

All profiles will be reviewed against the required skills and experience. Due to the high number of applications we will only be able to respond to successful applicants in the first instance. We thank you for your interest and the time taken to apply!