Identity Access Management Architect

Eames Consulting Group; Greater London; A distancia; GBP 96.000 - 165.000; Jornada completa

Descripción de la vacante

Eames Consulting Group is seeking an IAM Architect focused on external identity (CIAM) to design scalable access for non-employees. You will define the rules for registration, authentication, authorisation and lifecycle for external users, ensuring secure, scalable access.

Collaborating with security, delivery and engineering teams, you will ensure the architecture is implemented as designed and will author comprehensive documentation for wider teams.

Formación

• Active SC clearance (non-negotiable).
• Proven experience as an IAM architect, ideally with external identity (CIAM) at scale.
• Strong knowledge of OAuth 2.0, OpenID Connect, SAML and modern authentication patterns.
• Experience designing policy-based access models and the rules behind them.
• Hands-on familiarity with at least one major IAM platform (e.g. Entra External ID, Okta, Ping, ForgeRock).
• Comfortable talking to a security architect and a programme director.
• Ability to work independently without a daily chaser.

Responsabilidades

• Defining the architecture and design principles for external identity and access.
• Shaping the rules around registration, authentication, authorisation and lifecycle for external users.
• Designing how identity proofing, assurance levels and consent fit together.
• Making sensible calls on federation, SSO and delegated access.
• Working with security, delivery and engineering teams so the design gets built as drawn.
• Writing documentation that people will read and use.
• Challenging decisions when something won’t hold up.

Conocimientos

IAM architecture

External identity / CIAM at scale

OAuth 2.0

OpenID Connect

SAML

Federation and SSO

Policy-based access models

Herramientas

Entra External ID

Okta

Ping Identity

ForgeRock

Descripción del empleo

IAM Architect (External Identity) | 6-Month Rolling Contract | Inside IR35 | Active SC Clearance

Start: ASAP

Let’s get the essentials out of the way first, so you can decide in 30 seconds whether to keep reading.

This is an inside IR35 contract. It’s 99% remote. You need active SC clearance, not “in progress” or “should be through soon”. If that’s you, carry on.

The job

Our client is a professional services firm delivering a significant identity programme. The heart of it is external identity: the people who aren’t employees but still need secure access to online systems. Think members of the public, customers, partners and anyone else logging in from outside the organisation.

They don’t need another slide deck telling them identity matters. They need someone who can design how it works: the rules, the architecture and the patterns that decide who gets in, what they can see and how that holds up at scale.

What you’ll actually be doing

• Defining the architecture and design principles for external identity and access
• Shaping the rules around registration, authentication, authorisation and lifecycle for external users
• Designing how identity proofing, assurance levels and consent fit together
• Making sensible calls on federation, SSO and delegated access
• Working with security, delivery and engineering teams so the design gets built as drawn
• Writing documentation that people will read and use
• Challenging decisions, politely but firmly, when something won’t hold up

What you’ll need

• Active SC clearance (non-negotiable)
• Proven experience as an IAM architect, ideally with external identity (CIAM) at scale
• Strong knowledge of OAuth 2.0, OpenID Connect, SAML and modern authentication patterns
• Experience designing policy-based access models and the rules behind them
• Hands‑on familiarity with at least one major IAM platform [add: e.g. Entra External ID, Okta, Ping, ForgeRock, etc.]
• Comfortable talking to a security architect in the morning and a programme director in the afternoon
• The ability to work independently without needing a daily chaser

Nice to have

• Experience in government or other regulated environments
• Knowledge of digital identity standards and trust frameworks
• Previous consulting or professional services experience

How it works

• 6-month rolling contract, with every sign the work will continue
• Inside IR35, assessed and confirmed upfront, so no nasty surprises