IAM Architect

Conexess Group; Farmington Hills (MI); On-site; USD 130,000 - 170,000; Full time

Job summary

Conexess Group seeks an Identity and Access Management (IAM) Architect to own and mature RBAC across Entra ID, Active Directory, and external identity platforms. You will guide infrastructure, IT, and development teams as a trusted technical advisor.

The ideal candidate has deep Entra ID experience, lifecycle automation, and governance in regulated environments, with strong ability to translate risk into secure design decisions and compliant documentation.

Qualifications

• 5+ years of hands‑on IAM engineering experience, with at least 3 years focused on Entra ID (Azure AD) in enterprise environments.
• Deep knowledge of Active Directory, including group policy, OU design, domain trust models, and hybrid identity patterns.
• Experience designing and implementing RBAC models at scale in complex or legacy environments.
• Hands‑on experience with Entra ID Governance, including access reviews, entitlement management, lifecycle workflows, and Privileged Identity Management (PIM).
• Strong working knowledge of OAuth 2.0, OIDC, and SAML, sufficient to review developer implementations and identify security risk.
• Practical experience automating identity lifecycle events using Logic Apps, Azure Functions, PowerShell, or the Microsoft Graph API.
• Ability to communicate risk clearly to non‑technical stakeholders and produce compliance‑ready documentation.
• Bachelor's degree in Computer Science, Information Systems, or a related field, or equivalent professional experience.
• Relevant certifications: SC‑300, AZ‑500 or equivalent are a plus.

Responsibilities

• Design and implement enterprise RBAC across Entra ID, Active Directory, and Entra External ID.
• Lead identity lifecycle automation integrating HR systems with Entra ID to automate provisioning and deprovisioning.
• Govern directory structure and access hygiene across all directory platforms.
• Manage non‑human identities: service accounts, managed identities, and app registrations.
• Advise development teams on token handling, session management, and federation patterns.
• Drive Conditional Access policy design and own Privileged Identity Management configuration.
• Support Entra External ID governance with custom policy, user flows, and external identity federation.
• Produce compliance‑ready IAM documentation and audit inventories.

Skills

IAM engineering

Entra ID (Azure AD)

RBAC design

OAuth 2.0 / OIDC / SAML

Identity lifecycle automation

Education

Bachelor's degree or equivalent

SC‑300 / AZ‑500 certification

Tools

Logic Apps

Azure Functions

PowerShell

Microsoft Graph API

Job description

Identity and Access Management (IAM) Architect - JOB DESCRIPTION

Seeking an Identity and Access Management (IAM) Architect. As an IAM Architect, you will own and mature our identity security posture across a complex, multi-platform environment, serving as the primary driver of a structured role‑based access control (RBAC) program and a trusted technical advisor across infrastructure, IT, and development teams. The ideal candidate will have deep experience with Entra ID, Active Directory, identity lifecycle automation, and governing access in regulated enterprise environments.

Responsibilities

• Design and implement enterprise RBAC: Build a cohesive role‑based access control model across Entra ID, Active Directory, and Entra External ID, replacing ad hoc access grants with governed, role‑aligned entitlements.
• Lead identity lifecycle automation: Integrate the HR system with Entra ID to automate provisioning and deprovisioning, ensuring access changes are event‑driven and auditable at the point of hire, transfer, and termination.
• Govern directory structure and access hygiene: Define and enforce naming conventions, group structures, and access review cadences across all directory platforms.
• Manage non‑human identities: Govern service accounts, including managed identities, service principals, and app registrations, enforcing least privilege and credential hygiene across all environments.
• Advise development teams on identity security: Provide architectural guidance on token handling, session management, and federation patterns for teams building or maintaining identity‑adjacent systems.
• Drive Conditional Access and PIM: Lead Conditional Access policy design and own Privileged Identity Management configuration and the privileged access model for admin roles across Azure and M365.
• Support Entra External ID governance: Advise teams on External ID tenant configuration, custom policy, user flows, and external identity federation.
• Produce compliance‑ready documentation: Maintain IAM documentation including access control matrices, provisioning runbooks, and audit‑ready entitlement inventories supporting FCRA and FTC Safeguards Rule obligations.
• Collaborate across the security program: Align IAM initiatives with the broader security roadmap and participate in change management and architecture review processes alongside security engineers and the Cybersecurity Manager.

Required Skills & Experience

• 5+ years of hands‑on IAM engineering experience, with at least 3 years focused on Entra ID (Azure AD) in enterprise environments.
• Deep working knowledge of Active Directory, including group policy, OU design, domain trust models, and hybrid identity patterns.
• Demonstrated experience designing and implementing RBAC models at scale in complex or legacy environments.
• Hands‑on experience with Entra ID Governance, including access reviews, entitlement management, lifecycle workflows, and Privileged Identity Management (PIM).
• Strong working knowledge of OAuth 2.0, OIDC, and SAML, sufficient to review developer implementations and identify security risk.
• Practical experience automating identity lifecycle events using Logic Apps, Azure Functions, PowerShell, or the Microsoft Graph API.
• Ability to communicate risk clearly to non‑technical stakeholders and produce compliance‑ready documentation.
• Will accept any suitable combination of education, training, or experience.

Preferred Skills & Experience

• Experience in regulated industries such as financial services, fintech, or automotive with access control obligations.
• Familiarity with FTC Safeguards Rule requirements or equivalent data security regulatory frameworks.
• Prior experience integrating an HRIS platform (Workday, BambooHR, UKG, or similar) with Entra ID via SCIM or custom connector.
• Exposure to IGA platforms such as SailPoint, Saviynt, or Omada.
• Experience advising development teams on token validation, scope design, role claims, and secure session management.
• Bachelor's degree in Computer Science, Information Systems, or a related field, or equivalent professional experience.
• Relevant certifications: SC‑300 (Microsoft Identity and Access Administrator), AZ‑500 (Microsoft Azure Security Technologies), or equivalent.