Infrastructure Security and IAM Architect

Elfonze Technologies Pvt. Ltd.; United States; A distancia; USD 150.000 - 190.000; Jornada completa

Descripción de la vacante

Elfonze Technologies is seeking an Infrastructure Security and IAM Architect to design the target identity and infrastructure security architecture for a carve-out, covering hybrid domain controllers and Entra ID estate. You will own the target-state design and approach for moving users, mailboxes and collaboration content.

You will deliver high- and low-level designs, define SSO, MFA, CA and privileged access models, specify migration tooling, and collaborate with client architects across Azure

Formación

• 10+ years in infrastructure and security architecture.
• 5+ years designing identity solutions including on-prem AD clusters.
• Strong knowledge of AD, Kerberos, LDAP and DNS.
• Proficient with Entra ID and Entra Connect v2+.
• Hands-on experience with SSO, MFA and Conditional Access.
• Experience with Okta or Ping Identity.
• 3+ years of SAML, OAuth 2.0 and OpenID Connect.
• Understanding of RADIUS-based authentication and 802.1X.
• Migration tooling experience: BitTitan, Quest, AvePoint.
• Experience migrating mailbox, SharePoint and Teams, across Azure and AWS.

Responsabilidades

• Design the target identity architecture across on-premises Active Directory and Microsoft Entra ID.
• Define SSO, MFA, Conditional Access and privileged access models.
• Design directory synchronisation using Microsoft Entra Connect.
• Architect application sign-in and federation using SAML, OAuth 2.0 and OpenID Connect.
• Design network access authentication using RADIUS and 802.1X.
• Define infrastructure security controls: segmentation, firewalls, key and secrets management.
• Design landing zone security controls across Azure and AWS.
• Select and configure migration tooling for user, mailbox, SharePoint and Teams moves.
• Produce high-level and low-level designs and review with client architects.
• Define security logging requirements for identity and infrastructure events.

Conocimientos

SSO

MFA

CA

Entra ID

Herramientas

Entra Connect

BitTitan

Quest

AvePoint

Azure Key Vault

Descripción del empleo

Infrastructure Security and IAM Architect

Designs the identity, access and infrastructure security architecture for a carve-out, covering the hybrid domain controller and Entra ID estate. Owns the target-state design and the technical approach for moving users, mailboxes and collaboration content. Re-architects only where the separation requires it.

Job Responsibilities

Design the target identity architecture across on-premises Active Directory and Microsoft Entra ID

Define SSO, MFA, Conditional Access and privileged access models

Design directory synchronisation using Microsoft Entra Connect and tenant coexistence

Architect application sign-in and federation using SAML, OAuth 2.0 and OpenID Connect

Design network access authentication using RADIUS and 802.1X

Define infrastructure security controls: segmentation, firewalls, key and secrets management

Design landing zone security controls and guardrails across Azure and AWS

Select and configure migration tooling for user, mailbox, SharePoint and Teams moves

Produce high-level and low-level designs and review them with client architects

Define security logging requirements for identity and infrastructure events

Required Experience

10+ years of relevant experience in infrastructure and security architecture

5+ years designing and implementing identity, including on-premises domain controller clusters

Strong understanding of Active Directory, Kerberos, LDAP and DNS

Strong understanding of Microsoft Entra ID and Entra Connect version 2 or above, including Entra Domain Services

Hands-on experience with SSO, MFA and Conditional Access

Experience with at least one third-party identity provider such as Okta or Ping Identity

3+ years of experience with SAML and OAuth 2.0, plus OpenID Connect

Understanding of RADIUS-based authentication and 802.1X

Experience with migration tools such as BitTitan, Quest and AvePoint

Experience with mailbox, SharePoint, Teams and user migration

Experience with at least two cloud providers (Azure and AWS)

Experience designing and implementing landing zones with security controls and guardrails

Experience with Azure Key Vault or equivalent key management services

Deep understanding of hyper-converged infrastructure

Exposure to at least two OEMs or two cloud providers in each technology area

Strong communication skills, with prior experience working with UK and EU clients

Willingness to travel as required and to work in the client time zone

Prior infrastructure background alongside the specialism above

Prior experience in IT consolidations, mergers, demergers and carve-outs (mandatory)

Relevant professional certifications strongly recommended