Senior Identity Security Architect

TechDemocracy; Seattle (WA); On-site; USD 180,000 - 240,000; Full time

Job summary

TechDemocracy seeks a senior identity architect on the Build/Engineering team to define target-state architecture for privileged access, directory, cloud identity, and identity governance platforms, guiding deployment and migration across large initiatives. You will influence technical direction with autonomy and connect strategy to delivery for enterprise-scale programs.

The role requires deep expertise across authentication/authorization protocols, cloud and hybrid environments, and experience

Qualifications

• 15+ years of security or identity engineering experience.
• Significant experience as an identity/security architect on enterprise-scale environments.
• Led large-scale identity security modernization programs end to end from target-state design through deployment.

Responsibilities

• Define and own target-state architecture and reference designs for identity security platforms (BeyondTrust, Entra ID, AD, SailPoint).
• Lead architecture and deployment strategy for large-scale identity modernization initiatives (privileged access, identity governance, cloud identity, hybrid-identity, Zero Trust).
• Establish architecture standards, patterns, integration blueprints, and guardrails; act as design authority across delivery teams.
• Develop migration and deployment strategies ( sequencing, cutover, rollback, risk mitigation) for large user/system migrations.
• Architect integrations across identity platforms, cloud environments, and SaaS apps using SAML, OAuth/OIDC, SCIM, Kerberos, LDAP.
• Drive phishing-resistant authentication and least-privilege/PAM architecture enterprise-wide.
• Partner with engineering, security, platform/cloud, product, and PM to translate architecture into roadmaps.
• Provide technical leadership; review designs to ensure alignment with architecture and security requirements.
• Identify architectural risks and trade-offs; present recommendations to engineering and leadership.
• Contribute to security posture and data-handling requirements of modernization program.
• Leverage AI tooling to accelerate architecture analysis and solution evaluation.

Skills

Identity architecture

Security architecture

Enterprise-scale environments

Cloud identity

Zero Trust identity

Education

Bachelor’s or Master’s degree in Computer Science, Cybersecurity, IT

Tools

BeyondTrust

Microsoft Entra ID

Active Directory

Okta

SailPoint

Job description

• This is a senior, design-authority role on the Build / Engineering team.
• Resource will define the target-state architecture for our privileged access, access management, directory, cloud identity, and identity governance platforms; set the standards and patterns the engineering teams build against; and guide deployment and migration across large, complex initiatives.
• Resource will operate with significant autonomy, influence technical direction across multiple workstreams, and serve as the senior technical voice connecting strategy to delivery.
• This engagement is ideal for a seasoned identity architect who has led enterprise-scale identity modernization end to end from target-state design through production deployment.

What You'll Do:

• Define and own the target-state architecture and reference designs for the identity security platform across BeyondTrust (Password Safe, EPM, PRA), Microsoft Entra ID, Active Directory, and SailPoint IDN.
• Lead the architecture and deployment strategy for large-scale identity security modernization initiatives — privileged access transformation, identity governance modernization, cloud identity adoption, Active Directory and hybrid-identity modernization, and Zero Trust identity patterns.
• Establish architecture standards, design patterns, integration blueprints, and guardrails that the build/engineering teams implement against and serve as design authority through architecture and design reviews.
• Develop migration and deployment strategies — sequencing, cutover, rollback, and risk mitigation — for moving large user and system populations onto modern identity platforms with minimal disruption.
• Architect integrations across identity platforms, cloud (Azure, AWS, GCP), and enterprise/SaaS applications using APIs, federation, and provisioning standards (SAML, OAuth2/OIDC, SCIM, Kerberos, LDAP).
• Drive phishing-resistant authentication and least-privilege/PAM architecture across the enterprise.
• Partner with engineering leads, security architecture, platform/cloud teams, product, and program management to translate architecture into delivery roadmaps and executable workstreams.
• Provide technical leadership and guidance to build engineers; review designs and key implementations to ensure alignment to architecture and security requirements.
• Identify and document architectural risks, dependencies, and trade-offs; present recommendations and decisions to engineering and leadership audiences.
• Contribute to the security posture and control objectives of the modernization program, ensuring designs meet Nordstrom security, compliance, and data-handling requirements.
• Leverage AI tooling to accelerate architecture analysis, design documentation, and solution evaluation.

What You Bring:

• Bachelor’s or master’s degree in computer science, Cybersecurity, Information Technology, or equivalent education and experience.
• 15+ years of security or identity engineering experience, including significant experience as an identity/security architect on enterprise-scale environments.
• Demonstrated experience leading large-scale identity security modernization or transformation programs end to end

from target-state architecture through production deployment.

• Deep architecture-level expertise across two or more of the following, with strong working knowledge of the rest: BeyondTrust, Microsoft Entra ID, Active Directory, Okta, and SailPoint.
• Strong command of identity architecture fundamentals: authentication/authorization protocols (SAML, OAuth2/OIDC, SCIM, Kerberos, LDAP), federation, MFA and phishing-resistant authentication, RBAC/ABAC, least privilege, tiered administration, and Zero Trust identity.
• Proven experience designing integrations and migrations across hybrid and multi-cloud environments at scale.
• Experience setting architecture standards and acting as a design authority across multiple delivery teams.
• Excellent communication skills, able to align engineers, architects, and senior leadership around architecture decisions and trade-offs.
• Ability to operate independently in a fast-paced, multi-workstream program with high ambiguity.

Nice to Have:

• Architecture or security certifications such as CISSP, SABSA, TOGAF, Microsoft Identity & Access Administrator (SC-300), or SailPoint Certified Engineer.
• Experience with infrastructure-as-code (Terraform, Ansible) and CI/CD as enablers of identity platform delivery.
• Experience with identity threat detection and response (ITDR) and integrating identity signals into SIEM/SOAR.
• Large-scale retail, ecommerce, or other high-transaction enterprise experience.