Identity & Access Management Architect

Bestman Solutions; New York (NY); On-site; USD 120,000 - 180,000; Full time

Job summary

Bestman Solutions. International seeks an experienced IAM Architect/Engineer to shape and strengthen identity management across the organisation.

The role blends architectural decisions with hands-on engineering in a complex, engineering-led security environment. You will influence identity solutions across platforms and drive practical implementations that support innovation while maintaining rigorous security controls.

Qualifications

• Experience in IAM engineering or architecture across complex environments.
• Strong knowledge of authentication, authorization, federation and privileged access management.
• Experience with identity technologies such as AD, Entra ID, CyberArk, Vault.
• Understanding of OAuth 2.0, OpenID Connect, SAML and modern identity security principles.

Responsibilities

• Designing, improving and implementing IAM solutions across a complex technology environment.
• Developing approaches to authentication, authorization, and secrets management.
• Supporting identity solutions for users, apps, services and machine-to-machine communication.
• Working with identity protocols and federation technologies across cloud platforms.

Skills

IAM design

Security engineering

Technical leadership

Education

Bachelor's degree in Computer Science

Tools

Active Directory

Microsoft Entra ID

CyberArk

HashiCorp Vault

Job description

We're partnering with a highly technical firm within the financial industry as they continue to invest in and develop their cybersecurity capability.

Identity is a key part of that investment, and they're looking for an experienced Identity & Access Management Architect or Engineer to help shape and strengthen how identity is managed across the organisation.

This is an opportunity to work in a complex, engineering-led environment where security needs to support innovation rather than slow it down.

The firm is looking for someone who can bring strong technical knowledge, challenge existing approaches and help develop practical identity solutions that work across different platforms, applications and infrastructure.

What's particularly interesting is the breadth of the opportunity. You'll be involved in architectural decisions and longer-term planning, but also remain close to the engineering teams responsible for bringing those solutions to life.

The opportunity

You’ll play an important role in developing the firm's IAM capability, working closely with security, infrastructure and software engineering teams.

The role offers a combination of architecture, technical problem-solving and hands‑on involvement, with the opportunity to influence how identity services evolve across the business.

Your responsibilities will include:

• Designing, improving and implementing IAM solutions across a complex technology environment.
• Developing approaches to authentication, authorisation, privileged access and secrets management.
• Supporting identity solutions for users, applications, services and machine-to-machine communication.
• Working with identity protocols and federation technologies, including OAuth 2.0, OpenID Connect and SAML.
• Establishing IAM architecture standards, security controls and reusable engineering patterns.
• Reviewing existing identity capabilities, identifying technical gaps and recommending improvements.
• Working alongside developers and infrastructure engineers to integrate identity into applications, cloud platforms and services.
• Contributing to the wider IAM roadmap, balancing security requirements with operational and engineering needs.

This isn't a position focused solely on governance or producing architecture documentation. You'll need to understand how identity technologies work in practice and be comfortable getting involved in technical discussions and implementation decisions.

Who we're looking for

We're interested in speaking with experienced IAM Architects, Identity Engineers and Security Engineers who have taken ownership of identity solutions and enjoy solving complex technical challenges.

You don't necessarily need to have held the title of Architect. What's more important is your technical understanding, the environments you've worked in and your ability to design and deliver effective IAM solutions.

Ideally, you'll bring:

• Strong experience in Identity & Access Management engineering, solution design or architecture.
• Good knowledge of authentication, authorisation, federation and privileged access management.
• Experience with identity technologies such as Active Directory, Microsoft Entra ID, CyberArk, HashiCorp Vault or similar platforms.
• Understanding of OAuth 2.0, OpenID Connect, SAML and modern identity security principles.
• Exposure to cloud environments, ideally AWS, Azure or GCP.
• Familiarity with Linux, networking, containers or Kubernetes environments.
• Scripting or automation experience, particularly Python.
• The ability to work directly with technical teams, understand their challenges and translate security requirements into workable solutions.

Experience with Terraform, Ansible, infrastructure-as-code or Zero Trust architectures would be beneficial.

We're particularly interested in people who have worked in complex, highly engineered environments where identity needs to operate reliably across multiple technologies and platforms.

Financial services experience would be useful, but we're equally open to individuals from technology companies and other technically demanding organisations.

Why consider this opportunity?

There's a genuine opportunity to influence how IAM develops within the organisation, rather than simply maintain an established platform or work within a narrowly defined technical remit.

You’ll be joining a growing security function, working with experienced engineering teams and contributing to a wider programme of identity improvements.

Whether you’re an established IAM Architect looking for broader ownership or a technically strong IAM Engineer ready to take on more architectural responsibility, this could be an interesting next step.