Sr IAM Architect

3Core Systems, Inc; Florida; Hybrid; USD 140,000 - 180,000; Full time

Job summary

3Core Systems, Inc. is looking for a senior IAM Architect to assess, modernize, and optimize its user provisioning environment.

You will design scalable identity lifecycle processes across Workday, Banner, Active Directory, Entra ID, OneLogin, and downstream applications. The role requires hands-on provisioning expertise to establish authoritative identity sources, automate joiner/mover/leaver processes, and support employee and student identities including dual affiliations.

Qualifications

• 8+ years of enterprise IAM experience with architecture and design responsibilities.
• Ability to design modern, scalable target-state IAM architectures.
• Expertise in end-to-end user provisioning across HR/SIS systems and directories.
• Experience with joiner/mover/leaver, deprovisioning, and dual-affiliation scenarios.
• Knowledge of authoritative identity sources and ownership rules for critical attributes.
• Strong integration experience with HRIS/SIS/ERP like Workday, Banner, Entra ID.
• Proficiency in SAML, OIDC/OAuth, SCIM, LDAP, and Kerberos.

Responsibilities

• Assess and modernize provisioning environments to a modern IAM target state.
• Design secure, scalable identity lifecycle processes across systems such as Workday, Banner, AD, Entra ID, and downstream apps.
• Define governance and least-privilege models for access management.
• Lead the phased modernization roadmap with minimal production disruption.
• Review configurations, troubleshoot provisioning failures, and guide implementation.
• Establish monitoring, reconciliation, and error-handling for provisioning workflows.
• Collaborate with stakeholders and vendors to ensure alignment with security policies.

Skills

IAM architecture

Identity provisioning

Access governance

Cross-system integration

Stakeholder communication

Tools

Workday

Banner

Active Directory

Microsoft Entra ID

Entra Connect

CloudSync

OneLogin

SCIM

PowerShell

SQL

LDAP

Kerberos

SAML

OIDC/OAuth

Job description

Weston, Florida, United States | Posted on 10/22/2026

Title: IAMArchitect
Location: Weston,Florida (3 days onsite, hybrid)
Duration: Long-termcontract

RoleSummary:

• The Clientis seeking a seniorIdentity and Access Management Architecttoassess, modernize, and improve its user provisioning environment.
  
• Thearchitect will design secure, scalable, and reliable identity lifecycleprocesses across Workday, Banner, Active Directory, Microsoft Entra ID,OneLogin, and downstream applications.
  
• The rolerequires strong hands-on provisioning expertise to establish authoritativeidentity sources, automate joiner/mover/leaver processes, support employeeand student identities, including dual affiliations, and implementmonitoring, reconciliation, error handling, and deprovisioning safeguards.
  
• Thearchitect will define the target-state IAM architecture, create a phasedmodernization roadmap, and guide implementation according to modern IAM,security, governance, and least-privilege practices.
  

JobDescription:

• 8+years of enterprise IAM experience, with significant responsibility foridentity architecture and user-provisioning design.
  
• Provenability to assess an existing provisioning environment and design amodern, scalable target-state architecture.
  
• Expertknowledge of end-to-end user provisioning across HR/SIS systems, identityplatforms, directories, and downstream applications.
  
• Experiencedesigning joiner, mover, leaver, rehire, return, and deprovisioningprocesses.
  
• Experiencehandling complex identity scenarios, including employee/student dualaffiliations, duplicate identities, role changes, and multiple sourcerecords.
  
• Experienceestablishing authoritative identity sources and ownership rules forcritical identity attributes.
  
• Strongexperience integrating Workday, Banner, or comparable HRIS, SIS, and ERPplatforms with IAM systems.
  
• Expertknowledge of Microsoft Entra ID, Active Directory, Entra Connect, CloudSync, and cross-tenant synchronization.
  
• Experiencedesigning automated provisioning using SCIM, APIs, Microsoft Graph,PowerShell, SQL, file-based integrations, and middleware.
  
• Experienceimplementing provisioning safeguards, including reconciliation,validation, approval gates, retry processing, error handling, rollback,and mass-deletion protection.
  
• Abilityto design monitoring and alerting for failed provisioning, synchronizationissues, duplicate identifiers, stale accounts, and incomplete lifecycleevents.
  
• Experiencedefining modern access-assignment models using roles, groups, attributes,access packages, and least-privilege principles.
  
• Strongunderstanding of authentication, provisioning, authorization, and identitygovernance as separate but connected functions.
  
• Expertisewith SAML, OIDC/OAuth, SCIM, LDAP, and Kerberos.
  
• Experiencemodernizing legacy IAM platforms, custom scripts, databases, manualworkflows, and duplicated provisioning logic.
  
• Abilityto define the appropriate long-term roles of on-premises AD, Entra ID,multiple tenants, and legacy identity platforms.
  
• Experiencedesigning identity governance, access reviews, privileged access,service-account governance, and timely access removal.
  
• Abilityto create current-state and target-state architecture, identity-flowdiagrams, source-of-authority matrices, attribute mappings, and lifecyclestandards.
  
• Abilityto produce a prioritized, phased modernization roadmap that can berealistically implemented without disrupting production.
  
• Hands-ontechnical ability to review configurations and code, analyze identitydata, troubleshoot provisioning failures, lead proofs of concept, andguide implementation.
  
• Strongcommunication and knowledge-transfer skills for working with technicalteams, business owners, leadership, and vendors.