IAM Security Architect

Dev/Null Security; Sheffield; Remote; GBP 90,000 - 130,000; Full time

Job summary

Dev/Null Security is seeking a Security Architect with a strong engineering background to lead IAM design across large, complex environments. You will own solution designs, translate business requirements into architectures, and support engineers through implementation and handover.

The role covers workforce, privileged and non-human identities, including service accounts and cloud workloads. You will present recommendations at design authorities and with senior stakeholders.

Qualifications

• Significant IAM/security/platform engineering expertise in enterprise environments.
• Experience designing and delivering enterprise identity solutions.
• Strong knowledge of authentication, federation, provisioning, IGA and PAM.

Responsibilities

• Design secure, scalable identity services across cloud, SaaS, and on‑prem environments.
• Define authentication, SSO, federation, MFA patterns aligned to risk.
• Automate identity lifecycles, access requests, approvals and reviews.
• Define privileged access controls including just‑in‑time access and credential management.
• Prototype integrations with engineers and validate designs through proofs of concept.

Skills

IAM design

Security architecture

Platform engineering

Authentication & Federation

OAuth 2.0 / OIDC / SAML / SCIM

RBAC / ABAC / least privilege

Cloud identity services

Kubernetes / microservices

SPIFFE / SPIRE workload identities

Automation via APIs / IaC

Security governance & design reviews

Communication with stakeholders

Education

Relevant degree or equivalent practical experience

Security certifications desirable (CISSP/CISM/SABSA/TOGAF)

Tools

Kubernetes

Job description

Dev/Null Security is seeking a Security Architect with a strong engineering background to lead Identity and Access Management design across large, complex enterprise environments.

You will have built, integrated and operated identity services, and now own solution designs or be ready to take that step. You will turn business requirements into practical architectures, validate technical choices and support engineers through implementation and operational handover.

The role covers workforce, privileged and non-human identities, including service accounts, cloud workloads and emerging AI agent identities. You will produce high-level designs, reusable patterns and architecture decisions, and present and defend your recommendations at design authorities and with senior stakeholders.

Cybersecurity expertise and experience

• Significant hands‑on experience in IAM, security or platform engineering, with evidence of designing and delivering enterprise identity solutions. Senior engineers moving into architecture are welcome.
• Experience implementing and troubleshooting authentication, federation, provisioning and access controls, with a working understanding of identity governance and administration (IGA) and privileged access management (PAM).
• Strong understanding of OAuth 2.0, OpenID Connect, SAML and SCIM, including protocol selection, token validation, claims and trust relationships.
• Understanding of joiner, mover and leaver processes, access reviews, segregation of duties, role‑based and attribute‑based access control, and least privilege.
• Practical experience with cloud identity services, enterprise directories and application or API integration; understanding of containers, Kubernetes and microservices.
• Understanding of SPIFFE and SPIRE: workload identities, trust domains, SVIDs, node and workload attestation, credential rotation and federation. Ability to explain how workload authentication connects to separate authorisation controls.
• Awareness of IAM challenges in AI and agentic AI: agent ownership, autonomous versus user‑delegated access, permission boundaries, credential lifecycle and auditability.
• Ability to automate integrations and provisioning through APIs, scripting and infrastructure as code, and diagnose identity failures across application and infrastructure boundaries.
• Experience of operational delivery and technology transformation, with the ability to balance security, resilience, user experience, cost and legacy constraints.
• Clear communication with engineers, business stakeholders and executives; ability to translate requirements into designs, explain trade‑offs and work within security governance frameworks.

Qualifications and certifications

• Relevant degree or equivalent practical experience. CISSP, CISM, SABSA, TOGAF or relevant identity and cloud certifications are desirable.
• Practical delivery and sound technical judgement carry more weight than certifications. Production SPIRE experience or AI identity proof‑of‑concept work is desirable.

Accountabilities and responsibilities

IAM architecture and engineering:

• Design secure, scalable and resilient identity services spanning cloud, SaaS and on‑premises environments, with clear integration patterns and operational ownership.
• Define authentication, single sign‑on, federation, MFA and password less patterns appropriate to user needs, application capabilities and risk.
• Design identity lifecycle automation, access requests and approvals, entitlement models, access reviews and timely removal of access.
• Define privileged access controls, including just‑in‑time access, credential management, session accountability and tested emergency access.
• Work with engineers to prototype integrations, troubleshoot complex failures and validate designs through proofs of concept and implementation reviews.
• Plan migrations from legacy directories, federation services and long‑lived credentials, including dependencies, staged rollout, rollback and service continuity.

Workload identity with SPIFFE and SPIRE

• Define ownership, inventory and lifecycle controls for service accounts, service principals and workload identities, reducing unnecessary standing access and shared secrets.
• Assess where SPIFFE and SPIRE fit within the wider IAM architecture; define trust domains, workload registration, attestation and federation boundaries.
• Design patterns using short‑lived workload credentials, including X.509‑SVIDs or JWT‑SVIDs where appropriate, and mutual TLS for service authentication.
• Work with platform teams on credential delivery and rotation, availability, trust bundle management and integration with Kubernetes, service meshes and cloud services.
• Define how authenticated workload identities map to authorisation policies, including containment of compromised workloads and the limits of credential expiry and revocation.

IAM for AI

• Work with AI and application teams to assess identity requirements for agents accessing tools, APIs and enterprise data, applying established IAM controls to emerging use cases.
• Distinguish an agent’s identity, its hosting workload and any user it acts for; define clear ownership, delegated authority and limits on autonomous access.
• Design least‑privilege access with scoped, time‑bound credentials, controlled delegation and explicit approval for sensitive actions where required.
• Consider how prompt injection, excessive permissions, token theft or confused‑deputy behaviour could lead to unauthorised actions; enforce access controls outside model instructions.
• Define agent registration, access review, suspension and retirement, with audit trails linking agent actions to the relevant identity, user context and authorisation decision.

Identity monitoring and operational readiness

• Define identity audit events and monitoring requirements covering authentication, privilege changes, provisioning failures and suspicious access, without exposing credentials or tokens.
• Agree service health measures, recovery requirements, support runbooks and incident response procedures with operations and security teams.

Architecture and design

• Own solution designs aligned to functional and non‑functional requirements, business strategy, security principles and enterprise standards.
• Produce reference architectures, high‑level designs, integration patterns and architecture decision records that engineering teams can implement.
• Define target states and phased transformation roadmaps, with clear dependencies, migration steps and acceptance criteria.
• Provide implementation assurance, review detailed designs and resolve gaps between architecture intent and operational constraints.
• Assess technology options on capability, interoperability, supportability and commercial fit; explain recommendations and trade‑offs without relying on a single vendor.
• Maintain clear documentation and provide technical consultation to transformation programmes and teams outside the identity domain.

Governance

• Present and defend designs at technical design authorities, adapting the level of detail for executives, engineering teams and specialist reviewers.
• Ensure architectures, decision records, deviations and technical risks undergo appropriate peer review and governance approval.
• Map design choices to security policies, control objectives and applicable compliance requirements; record exceptions and compensating controls.

Risk and dependency management

• Identify, manage and elevate technical and delivery risks, including identity outages, excessive access, legacy dependencies and migration failure.
• Explain the security and operational consequences of design decisions, with practical remediation options and accountable owners.
• Coordinate dependencies across identity, platform, application, AI, networking and security operations teams.

Leadership and teamwork

• Provide technical leadership through design and delivery, mentor engineers and help teams develop their architecture capability.
• Challenge assumptions constructively and communicate complex identity concepts clearly to technical and non‑technical stakeholders.
• Build effective relationships with clients, delivery partners and internal teams; make decisions that account for risk, delivery effort, cost and long‑term support.

Working at DevNull Security

Whilst DevNull Security is a remote‑first company, our consulting team may be required to travel to client sites up to 3 times per week, depending on project and customer needs.

We believe that a career in cybersecurity should be accessible to everyone. We actively welcome applicants from all walks of life, regardless of race, ethnicity, gender identity, age, sexual orientation, disability, neurodiversity, socioeconomic background, or any other aspect of identity.

As a growing company, we’re committed to fostering an inclusive, equitable, and accessible hiring experience. We proactively offer adjustments during application and assessment - tell us what you need.