Senior IAM Architect

Xtensys; Knoxville (TN); A distancia; USD 135.000 - 150.000; Jornada completa

Descripción de la vacante

Xtensys is seeking a Senior IAM Architect to design, document, and mature identity and access management across Xtensys and its customers. You will own the current state, define the future state, and deliver credible artifacts for CISOs and system admins.

The role requires 8+ years in IAM, deep AD and Entra ID expertise, PowerShell, and integration work with Jira and Workday. You will collaborate with HR, security, and operations to implement lifecycle workflows, RBAC, and governance across

Formación

• 8+ years of IAM experience with design, implementation and ownership of enterprise identity systems.
• Experience designing Joiner, Mover, Leaver workflows in multi-domain environments.
• Experience in healthcare or regulated environments with HIPAA compliance obligations.

Responsabilidades

• Design and implement enterprise RBAC models across AD and Entra ID.
• Lead the ongoing optimization of IAM platforms including ADManager Plus & M365 Manager.
• Develop and enforce IAM policies, lifecycle SLAs, and offboarding standards.
• Partner with cybersecurity, compliance, HR and ops to translate business needs into IAM designs.

Conocimientos

Active Directory

Microsoft Entra ID

PowerShell scripting

ManageEngine ADManager Plus

ManageEngine M365 Manager

HIPAA compliance

Herramientas

Jira

Workday

ADManager Plus

MS 365 Manager

Descripción del empleo

Who We Are

Xtensys is a rapidly growing managed service provider delivering innovative technology solutions to health systems, beginning in New York and expanding nationwide. Owned by two industry leaders with a strong focus on advancing rural and community healthcare, Xtensys is executing several major initiatives and scaling quickly. With a team of more than 500 professionals, we are building a people-centered culture rooted in collaboration, innovation, and strategic thinking.

How We Work

East Coast Alignment: Our core operational and collaboration hours follow the Eastern Time Zone (ET), keeping our workflows synchronized with our primary clients and systems.

Why Join Us?

Mission-Driven Work: You are the "bridge" ensuring technology serves health systems and their patients when they need it most. Autonomy & Ownership: We trust you. You’ll lead projects, define success, and manage complexities with total support. A Culture of Innovation: Have a fresh perspective? We want it. We encourage risk‑taking and continuous improvement. Continuous Growth: We fuel your "restless curiosity" with opportunities to expand your skillset and mentor others.

Job Requisition

• Work Arrangement: Remote
• Compensation Range: $135,000.00 - $150,000.00 per year

The Role

Your Mission: The Senior IAM Architect is a senior technical lead responsible for designing, documenting, and driving the maturation of identity and access management capabilities across the Xtensys environment and its customers. This is not a purely advisory role. The right candidate will own the current state, define the future state, and build the steppingstones between them, producing deliverables that are equally credible to a CISO and a systems administrator.

What You'll Do Day-to-Day

Proactive Governance and Anomaly Detection

Continuously monitor identity systems, access patterns, lifecycle workflows, and audit logs for anomalies, policy violations, and process gaps without waiting for issues to be escalated. Independently investigate anomalies, document root cause findings, and implement or recommend corrective actions with minimal direction. Establish and maintain proactive monitoring practices including stale account detection, orphaned access identification, offboarding compliance tracking, and privilege creep analysis. Maintain a standing risk and improvement register for the IAM program, self-updating it as new findings are identified and tracking items through resolution.

Current State Assessment and Documentation

Assess, document, and baseline all primary IAM workflows including Joiner, Mover, Leaver, Leave of Absence, and Reactivation processes across all Xtensys-managed domains. Identify and document manual process steps, tooling gaps, compliance exposure, and quality control risks in existing workflows. Maintain living documentation of the IAM environment including architecture diagrams, process flows, and system integration maps.

Identity Lifecycle Management

Design, implement, and optimize Joiner, Mover, and Leaver workflows across on‑premises Active Directory, Microsoft Entra ID, and integrated SaaS platforms. Reduce manual lifecycle work in the current ManageEngine ADManager Plus environment through targeted workflow automation, role template optimization, and Jira integration improvements. Design and implement integration improvements between lifecycle event sources — including Jira and Workday — and ManageEngine ADManager Plus for on‑premises Active Directory environments and ManageEngine M365 Manager for Microsoft 365 environments, covering lifecycle event triggering, attribute mapping, and provisioning automation across both platforms independently. Partner with business stakeholders, HR, clinical operations, and application owners to gather access and provisioning requirements, translating business needs into IAM workflow designs and platform configurations. Define and enforce offboarding standards including cross‑domain account disablement and privileged account closure within defined SLAs.

ManageEngine Platform Maturation (ADManager Plus & M365 Manager)

Lead the ongoing optimization and expansion of ManageEngine ADManager Plus for on‑premises Active Directory environments, including role‑based template development, delegated workflow design, provisioning automation, and Jira and Workday integration improvements. Implement and mature ManageEngine M365 Manager for Microsoft 365 environments, extending lifecycle management, governance reporting, and access controls across Microsoft 365 and Entra ID with equivalent Jira and Workday integration coverage. Design and implement access certification campaigns, attestation workflows, and governance reporting within each platform independently, maintaining consistency in standards and controls across both environments. Identify gaps in current platform coverage and develop a roadmap for expanding automation and governance capabilities across both tools.

Identity Governance and Access Control

Design and implement enterprise RBAC models across Active Directory and Entra ID. Conduct and support periodic access reviews, recertifications, and audit evidence collection across all managed identity systems. Develop and enforce IAM policies covering account standards, naming conventions, attribute requirements, and lifecycle SLAs. Partner with cybersecurity and compliance teams to ensure IAM controls satisfy HIPAA, NIST 800‑53, and organizational audit requirements.

Technical Operations and Escalation

Serve as the senior technical escalation point for identity‑related service tickets, provisioning failures, and access disputes. Monitor IAM infrastructure for performance, availability, and security anomalies; proactively identify and remediate issues.

Who You Are & What You'll Bring

Proven Track Record: 8+ years of hands‑on IAM experience with a combination of design, implementation, and operational ownership of enterprise identity systems. Demonstrated experience producing current state assessments, IAM program roadmaps, and executive‑facing communications for senior leadership audiences. Experience designing and managing Joiner, Mover, Leaver workflows in complex multi‑domain or post‑merger environments. Experience with Workday‑to‑Active Directory integration including HR‑driven provisioning, attribute mapping, and lifecycle synchronization. Experience implementing or operating in a healthcare or regulated industry environment with HIPAA compliance obligations.

Technical Skills & Experience

Deep expertise with Microsoft Active Directory and Microsoft Entra ID including hybrid identity, Conditional Access, and delegated administration. Strong PowerShell scripting capability for lifecycle automation, audit log analysis, group membership management, and reporting. Proficiency with ManageEngine ADManager Plus including role‑based templates, delegated workflows, and provisioning automation. Experience with ManageEngine M365 Manager including license management,