Principal Architect - Identity, Access, and Management

Lumen; Salem (OR); Remote; USD 160,000 - 213,000; Full time

Benefits offered by this job

Health benefits

Life benefits

Voluntary lifestyle benefits

Job summary

Lumen is seeking a senior security architect to define and own IAM and security architecture for its NaaS platform and AI/agent ecosystems. You will embed security into design, align with FedRAMP and compliance, and lead multi-cloud identity efforts across portals, APIs, and services.

The role emphasizes Zero Trust, CIAM, SSO, and IAM-as-Code, with heavy collaboration with the Security team to shape secure, scalable, and AI-enabled connectivity for government and enterprise customers.

Qualifications

• Bachelor's degree in CS/Engineering/InfoSec with 12+ years of relevant experience or
• Master's degree with 10+ years of relevant experience
• CISSP, CISM, or equivalent security certification preferred

Responsibilities

• Own IAM strategy and target-state architecture across Lumen's NaaS identity ecosystem (LIAM/ECAPS, Entra ID/B2C, AWS IAM).
• Design and operationalize Zero Trust identity principles: continuous verification, least privilege, risk-based access.
• Architect CIAM: portal, mobile, and API access patterns with security and user experience balance.
• Define authentication and federation standards: OAuth 2.0, OpenID Connect, SAML across APIs and surfaces.
• SSO architecture across NaaS portal, partner portals, and government-facing services (EntraB2C).
• Develop IAM governance: RBAC/ABAC, access lifecycle, entitlement reviews, audit trails.
• Define IAM-as-Code: Terraform-based identity config, version-controlled, auditable.
• Architect security for agentic AI systems: agent authentication, audit trails, token lifecycle for agents.
• Provide security architecture for FedRAMP-aligned government initiatives: boundary preservation, tokenization, identity flow.
• Embedded DJAS security architect for multi-cloud networking: IAM and security boundaries across cloud-to-cloud/physical interconnects.
• Security reviews on NaaS designs: threat modeling, attack surface analysis, risk-based recommendations.
• Define security NFRs for DJAS designs from a security perspective.
• Partner with Lumen Security to bring security perspective into DJAS design work proactively.

Skills

AI-first

IAM architecture

Zero Trust

CIAM

OAuth/OIDC/SAML

Threat modeling

Education

Bachelor's degree + 12+ years

Master's degree + 10+ years

Tools

Microsoft Entra ID/Azure AD

AWS IAM

Terraform

Entra B2C

Job description

Lumen is the trusted network for the AI‑powered world, connecting people, data, and applications through our expansive fiber network and connected ecosystem. We enable secure, high‑performance connectivity across cloud, edge, and AI workloads for enterprises, governments, and communities.

At Lumen, you’ll work on infrastructure customers rely on today and build for what’s next, where performance, security, and resilience matter.

This is a high accountability environment where bold ideas drive real innovation for our customers, partners, and industry. The work is challenging, expectations are clear, and trust is built into how we operate. If you’re ready to take ownership, deliver meaningful impact, and help shape the future of AI‑ready connectivity, join us today.

The Role

Define and own identity, access management, and security architecture for Lumen's NaaS platform,

customer-facing digital services, and AI/agent ecosystems. This role embeds security architecture directly

into the Digital Journey Architecture and Solutions organization - providing the team with IAM and security

expertise at the point of design, not as a downstream review function.The scope spans customer portal identity (who can access what and how), API security and authentication standards (OAuth2, OIDC, SAML), SSO integration (including Entra B2C for enterprise and government customers), FedRAMP and compliance-aligned security architecture, and the emerging security

requirements of agentic AI systems. This role also serves as the primary DJAS interface for security

architecture related to complex multi-cloud networking integrations and Lumen's public sector initiatives.

Location

This is a remote opportunity open to candidates located anywhere in the U.S.

The Main Responsibilities

• Own IAM strategy and target-state architecture across Lumen's NaaS identity ecosystem:LIAM/ECAPS, Microsoft Entra ID/B2C, AWS IAM.

• Design and operationalize Zero Trust identity principles: continuous verification, risk-based access,least privilege enforcement.

• Architect customer identity and access management (CIAM): web portal, mobile, and API accesspatterns with security and customer experience in balance.

• Define authentication and federation standards: OAuth 2.0, OpenID Connect, SAML - enforced across

• APIs and customer-facing surfaces.

• Design SSO architecture across NaaS portal, partner portals, and government-facing services (EntraB2C).

• Develop IAM governance frameworks: RBAC/ABAC models, access lifecycle, entitlement review, auditevidence.

• Define IAM-as-Code practices: Terraform-based identity configuration, version-controlled, auditable

• Architect security for agentic AI systems: agent authentication, authorization boundaries, audit trails forAI-generated actions, token lifecycle management for agents.

• Provide security architecture for FedRAMP-aligned government initiatives: boundary preservation,tokenization patterns, identity flow compliance.

• Serve as the embedded DJAS security architect for multi-cloud networking integration: define IAM andsecurity boundary requirements across cloud-to-cloud and cloud-to-physical network interconnects

• Conduct security architecture reviews on NaaS designs: threat modeling, attack surface analysis,risk-based recommendations.

• Define security NFRs for DJAS architecture work: what every design must address from a securityperspective regardless of work type.

• Partner with Lumen's Security team (not owned by DJAS) and bring the security perspective into DJASdesign work proactively.

What We Look For in a Candidate

• Bachelor's degree in computer science, engineering, information security, or related field with 12+years of relevant experience or

• Master's degree with 10+ years of relevant experience

• AI-first practitioner - actively integrates AI tools (LLMs, coding assistants, AI-powered analysis anddesign tools) as a routine part of architecture and engineering work, not as an occasional experiment.

• Candidates must demonstrate specific, current examples of how AI has meaningfully accelerated orimproved their work.

• CISSP, CISM, or equivalent security certification preferred

• Deep expertise in enterprise IAM architecture: Microsoft Entra ID/Azure AD, AWS IAM - productionscale

• Expert knowledge of OAuth 2.0, OpenID Connect, and SAML - not just implementation but architectureand standards governance

• Customer identity (CIAM) experience: portal, mobile, and API access patterns

• Zero Trust architecture principles and implementation experience

• RBAC/ABAC model design at enterprise scale

• FedRAMP, FISMA, or NIST 800-53 compliance architecture experience

• Security architecture for API ecosystems: API gateway security, token management, key rotation,scope enforcement

• Threat modeling disciplines (STRIDE or equivalent)

Preferred

• Experience securing agentic AI systems or autonomous workflow platforms

• Microsoft Entra B2C (government/B2C federated identity) experience

• Experience with multi-cloud networking security or cloud-to-physical network security boundaries

• (SD-WAN, SASE, network security gateways)

• PAM (Privileged Access Management) architecture experience

• IAM-as-Code: Terraform-based identity configuration management

• Government/Public Sector cloud security architecture experience (GovCloud, FedRAMPHigh/Moderate)

• Understanding of compliance frameworks across multiple regulators: ISO 27001, SOC 2, PCI-DSS,GDPR

Compensation

This information reflects the anticipated base salary range for this position based on current national data. Minimums and maximums may vary based on location. Individual pay is based on skills, experience and other relevant factors.

Location Based Pay Ranges

$152,066 - $202,755 in these states: AL AR AZ FL GA IA ID IN KS KY LA ME MO MS MT ND NE NM OH OK PA SC SD TN UT VT WI WV WY

$159,670 - $212,893 in these states: CO HI MI MN NC NH NV OR RI

$167,273 - $223,031 in these states: AK CA CT DC DE IL MA MD NJ NY TX VA WA

Lumen offers a comprehensive package featuring a broad range of Health, Life, Voluntary Lifestyle benefits and other perks that enhance your physical, mental, emotional and financial wellbeing. We're able to answer any additional questions you may have about our bonus structure (short-term incentives, long-term incentives and/or sales compensation) as you move through the selection process.

Learn more about Lumen's:

Benefits (https://jobs.lumen.com/global/en/benefits-statement)

Bonus Structure

Life at Lumen

Life at Lumen is human and connected, even in a fast moving, AI‑focused organization. We set clear expectations and trust people to meet them. With real support and shared accountability, teams collaborate better, move faster, and deliver meaningful outcomes.

Our Lumen 8 behaviors guide how we interact, make decisions, and work together, shaping a culture built to perform and win.

To learn more about Life at Lumen and how we live the Lumen 8, please visit:

https://jobs.lumen.com/global/en/life-at-lumen

Background Screening

If you are selected for a position, there will be a background screen, which may include checks for criminal records and/or motor vehicle reports and/or drug screening, depending on the position requirements. For more information on these checks, please refer to the Post Offer section of our FAQ page (https://jobs.lumen.com/global/en/faq) . Job-related concerns identified during the background screening may disqualify you from the new position or your current role. Background results will be evaluated on a case‑based basis.

Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.

Equal Employment Opportunities

We are committed to providing equal employment opportunities to all persons regardless of race, color, ancestry, citizenship, national origin, religion, veteran status, disability, genetic characteristic or information, age, gender, sexual orientation, gender identity, gender expression, marital status, family status, pregnancy, or other legally protected status (collectively, “protected statuses”). We do not tolerate unlawful discrimination in any employment decisions, including recruiting, hiring, compensation, promotion, benefits, discipline, termination, job assignments or training.

Privacy Notice

Lumen is committed to protecting the privacy and security of personal information collected during the recruitment and hiring process. Our Applicant Privacy Notice explains how we collect, use, disclose, and protect applicant information, as well as how individuals may request access to or deletion of their personal data.

To review Lumen’s Global Employment Applicant and Talent Community Privacy Notice, please visit:

https://jobs.lumen.com/global/en/privacy-notice

Disclaimer

The job responsibilities described above indicate the general nature and level of work performed by employees within this classification. It is not intended to include a comprehensive inventory of all duties and responsibilities for this job. Job duties and responsibilities are subject to change based on evolving business needs and conditions.

In any materials you submit, you may redact or remove age-identifying information such as age, date of birth, or dates of school attendance or graduation. You will not be penalized for redacting or removing this information.