Senior IAM Architect

Xtensys; Mission (KS); A distancia; USD 135.000 - 150.000; Jornada completa

Descripción de la vacante

You will optimize tools like ManageEngine ADManager Plus and M365 Manager, build automation, and drive enterprise RBAC, attestations, and access governance across on-prem and cloud platforms in a distributed, remote-friendly setting.

Formación

• 8+ years of hands-on IAM experience with design, implementation, and operational ownership.
• Experience designing and managing Joiner, Mover, Leaver workflows in complex environments.
• Experience with Workday-to-AD integration including provisioning and attribute mapping.
• Hybrid identity management with Entra ID and on-premises AD.
• Strong PowerShell scripting for lifecycle automation.
• Familiarity with HIPAA, NIST 800-53 controls in healthcare/regulated settings.

Responsabilidades

• Proactively monitor IAM systems for anomalies and governance gaps.
• Document root causes and implement corrective actions with minimal direction.
• Develop and maintain IAM process documentation, diagrams, and maps.
• Design and optimize Joiner/Mover/Leaver workflows across AD and Entra ID.
• Lead lifecycle automation integrations with Jira and Workday.
• Collaborate with stakeholders to translate business needs into IAM configurations.

Conocimientos

IAM design

Joiner/Mover/Leaver

Workday integration

Entra ID Hybrid

PowerShell scripting

HIPAA compliance

Herramientas

ADManager Plus

M365 Manager

Jira

Workday

Active Directory

Entra ID

Descripción del empleo

# **Who We Are**Xtensys is a rapidly growing managed service provider delivering innovative technology solutions to health systems, beginning in New York and expanding nationwide. Owned by two industry leaders with a strong focus on advancing rural and community healthcare, Xtensys is executing several major initiatives and scaling quickly. With a team of more than 500 professionals, we are building a people-centered culture rooted in collaboration, innovation, and strategic thinking.How We Work:* East Coast Alignment: Our core operational and collaboration hours follow the Eastern Time Zone (ET), keeping our workflows synchronized with our primary clients and systems.* Mission-Driven Work: You are the \"bridge\" ensuring technology serves health systems and their patients when they need it most.* Autonomy & Ownership: We trust you. You'll lead projects, define success, and manage complexities with total support.* Continuous Growth: We fuel your \"restless curiosity\" with opportunities to expand your skillset and mentor others.**Job Requistion:****Work Arrangement**:Remote**Compensation Range:**$135,000.00 - $150,000.00 per year**The Role:****Your Mission:** The **Senior IAM Architect** is a senior technical lead responsible for designing, documenting, and driving the maturation of identity and access management capabilities across the Xtensys environment and its customers. This is not a purely advisory role. The right candidate will own the current state, define the future state, and build the steppingstones between them, producing deliverables that are equally credible to a CISO and a systems administrator.This role requires a high degree of independent judgment and self-direction. The IAM Architect is expected to proactively identify process gaps, access anomalies, governance risks, and operational inefficiencies without waiting to be directed. When something is wrong or could be improved, the expectation is that you investigate it, document your findings, and bring a recommendation, not just an observation. The IAM Manager should be learning about problems and proposed solutions together, not assigning discovery work.The role operates across two horizons simultaneously. In the near term, the Architect will optimize existing tooling, including ManageEngine ADManager Plus and ManageEngine M365 Manager, to reduce manual lifecycle work, improve governance controls, and expand automation coverage across on-premises and cloud-connected environments. In the longer term, the Architect will lead the continued maturation of the IAM program including enterprise RBAC and access certification programs built on the ManageEngine platform suite.This role may mentor or provide technical direction to junior IAM team members but does not carry formal supervisory responsibility at this time.**What You'll Do Day-to-Day:****Proactive Governance and Anomaly Detection:*** Continuously monitor identity systems, access patterns, lifecycle workflows, and audit logs for anomalies, policy violations, and process gaps without waiting for issues to be escalated.* Independently investigate anomalies, document root cause findings, and implement or recommend corrective actions with minimal direction.* Establish and maintain proactive monitoring practices including stale account detection, orphaned access identification, offboarding compliance tracking, and privilege creep analysis.* Maintain a standing risk and improvement register for the IAM program, self-updating it as new findings are identified and tracking items through resolution.**Current State Assessment and Documentation:*** Assess, document, and baseline all primary IAM workflows including Joiner, Mover, Leaver, Leave of Absence, and Reactivation processes across all Xtensys-managed domains.* Identify and document manual process steps, tooling gaps, compliance exposure, and quality control risks in existing workflows.* Maintain living documentation of the IAM environment including architecture diagrams, process flows, and system integration maps.**Identity Lifecycle Management:*** Design, implement, and optimize Joiner, Mover, and Leaver workflows across on-premises Active Directory, Microsoft Entra ID, and integrated SaaS platforms.* Reduce manual lifecycle work in the current ManageEngine ADManager Plus environment through targeted workflow automation, role template optimization, and Jira integration improvements.* Design and implement integration improvements between lifecycle event sources - including Jira and Workday - and ManageEngine ADManager Plus for on-premises Active Directory environments and ManageEngine M365 Manager for Microsoft 365 environments, covering lifecycle event triggering, attribute mapping, and provisioning automation across both platforms independently.* Partner with business stakeholders, HR, clinical operations, and application owners to gather access and provisioning requirements, translating business needs into IAM workflow designs and platform configurations.* Define and enforce offboarding standards including cross-domain account disablement and privileged account closure within defined SLAs.**ManageEngine Platform Maturation (ADManager Plus & M365 Manager):*** Lead the ongoing optimization and expansion of ManageEngine ADManager Plus for on-premises Active Directory environments, including role-based template development, delegated workflow design, provisioning automation, and Jira and Workday integration improvements.* Implement and mature ManageEngine M365 Manager for Microsoft 365 environments, extending lifecycle management, governance reporting, and access controls across Microsoft 365 and Entra ID with equivalent Jira and Workday integration coverage.* Design and implement access certification campaigns, attestation workflows, and governance reporting within each platform independently, maintaining consistency in standards and controls across both environments.* Identify gaps in current platform coverage and develop a roadmap for expanding automation and governance capabilities across both tools.**Identity Governance and Access Control:*** Design and implement enterprise RBAC models across Active Directory and Entra ID.* Conduct and support periodic access reviews, recertifications, and audit evidence collection across all managed identity systems.* Develop and enforce IAM policies covering account standards, naming conventions, attribute requirements, and lifecycle SLAs.* Partner with cybersecurity and compliance teams to ensure IAM controls satisfy HIPAA, NIST 800-53, and organizational audit requirements.**Technical Operations and Escalation:*** Serve as the senior technical escalation point for identity-related service tickets, provisioning failures, and access disputes.* Monitor IAM infrastructure for performance, availability, and security anomalies; proactively identify and remediate issues.**Who You Are & What You'll Bring:****Proven Track Record:*** 8+ years of hands-on IAM experience with a combination of design, implementation, and operational ownership of enterprise identity systems.* Demonstrated experience producing current state assessments, IAM program roadmaps, and executive-facing communications for senior leadership audiences.* Experience designing and managing Joiner, Mover, Leaver workflows in complex multi-domain or post-merger environments.* Experience with Workday-to-Active Directory integration including HR-driven provisioning, attribute mapping, and lifecycle synchronization.* Experience implementing or operating in a healthcare or regulated industry environment with HIPAA compliance obligations.**Technical Skills & Experience:*** Deep expertise with Microsoft Active Directory and Microsoft Entra ID including hybrid identity, Conditional Access, and delegated administration.* Strong PowerShell scripting capability for lifecycle