Sr. Identity Access Management Architect

Universal Music Group; Nashville (TN); On-site; USD 164,000 - 200,000; Full time

Benefits offered by this job

Medical coverage

Mental health coverage

Fertility coverage

Wellbeing stipend

Student Loan help

401(k) vesting

Flexible PTO

Paid holidays

Summer Fridays

Parental leave

Job summary

Universal Music Group seeks a Sr. Identity Access Management Architect to lead enterprise IAM design and delivery across on‑premises and multi‑cloud environments.

You will drive strategies for Access Management, IGA, PAM, PKI, and Directory Services, collaborating with cross‑functional teams and executives to implement scalable, secure identity solutions.

The role emphasizes technical leadership, governance, and modernization initiatives within a globally distributed organization.

Qualifications

• 10+ years of IAM or Security Architecture experience.
• Strong expertise with IAM protocols and cloud identity models.
• Hands-on with CyberArk, PingOne, EntraID, Saviynt, and AD.
• Expert understanding of Authentication, Authorization, PKI, MFA, federation, and PAM.
• Experience designing secure APIs and automating operations.
• Proven leadership across security, infra, compliance teams.
• Experience in multi-cloud and hybrid environments.
• Excellent communication and leadership at all levels.

Responsibilities

• Architect enterprise IAM solutions aligned with security policies and compliance.
• Lead PAM, IGA, SSO, MFA, Federation, PKI, and Directory Services.
• Define technical direction for IAM tools and implementation framework.
• Lead architecture planning for employees, partners, customers, and non-human identities.
• Establish target-state identity architecture and guide engineers.
• Develop secure authentication, authorization, and provisioning workflows.
• Integrate identity services into apps and infra via APIs/automation.
• Engage stakeholders to communicate strategy and drive modernization.
• Create and maintain IAM architecture docs and standards.
• Review designs to ensure security and architecture compliance.

Skills

IAM protocols

Enterprise IAM design

Multi-cloud identity

API security

Cross-functional leadership

Agile environments

Education

Bachelor’s or Master’s Degree in Computer Science or Engineering

CISSP

CISM

Microsoft Identity and Access Administrator

TOGAF

Tools

CyberArk

PingOne

Ping Davinci

EntraID

Saviynt

HashiCorp Vault

DigiCert

Onfido

Active Directory

Job description

We are UMG, the Universal Music Group. We are the world’s leading music company. In everything we do, we are committed to artistry, innovation and entrepreneurship. We own and operate a broad array of businesses engaged in recorded music, music publishing, merchandising, and audiovisual content in more than 60 countries. We identify and develop recording artists and songwriters, and we produce, distribute and promote the most critically acclaimed and commercially successful music to delight and entertain fans around the world.

We are currently seeking an experienced Sr. Identity Access Management Architect to lead architectural design, strategic planning, and delivery across the full Identity & Access Management landscape. The Sr. Identity Access Management Architect will play a critical role in shaping UMG’s global identity ecosystem across areas such as Access Management, IGA, PAM, Directory Services, and PKI.

This hands-on role will drive scalable and secure identity solutions, leading complex integrations across on-premises and multi-cloud environments. The successful candidate will possess deep technical expertise, a strategic mindset, and a strong ability to influence cross-functional teams and executive stakeholders.

Job Functions:

• Architect and design enterprise-wide IAM solutions aligned with business goals, security policies, and compliance requirements.

• Provide leadership and oversight for strategic IAM functions including PAM, IGA, SSO, MFA, Federation, PKI, Directory Services, and Secrets Management.

• Define technical direction for IAM tools and develop overall strategic framework for implementation across the company with an emphasis on standard configurations.

• Lead architecture planning and lifecycle designs for all personas including employees, partners, customers, and non-human identities.

• Establish the target-state identity architecture and effectively communicate and guide engineers to implementing that vision.

• Develop secure and scalable authentication, authorization, and account provisioning workflows.

• Partner with engineering teams to integrate identity services into applications and infrastructure using APIs and automation pipelines.

• Evaluate complex business requirements and effectively guide cross-functional teams to implement secure identity frameworks.

• Create and maintain architectural documentation, standards, and design patterns for IAM services.

• Contribute to solution development and code when needed, and review designs to ensure compliance with architecture and security standards.

• Engage with internal and external stakeholders to communicate strategy, resolve roadblocks, and champion IAM modernization initiatives.

Job Requirements:

Qualifications:

• 10+ years of experience in IAM or Security Architecture roles, with demonstrated success in designing enterprise-scale IAM platforms

• Strong expertise with IAM protocols (SAML, OAuth2, OIDC, SCIM, LDAP, Kerberos, FIDO) and modern cloud identity models

• Extensive hands‑on experience with products like CyberArk, PingOne, Ping Davinci, EntraID, Saviynt, HashiCorp Vault, Digicert, Onfido, and Active Directory

• Expert‑level understanding of Authentication, Authorization, Directory Services, PKI, MFA, Federation, and PAM

• Experience designing secure APIs and automating operational functions

• Proven ability to lead architectural governance and collaborate across security, infrastructure, application, and compliance teams

• Track record of implementing secure, scalable identity solutions in multi‑cloud and hybrid environments

• Excellent communication and leadership skills with the ability to influence at all levels of the organization

• Experience working in Agile environments with cross‑functional engineering teams

Desirable:

• Bachelor’s or Master’s Degree in Computer Science, Engineering, or related technical discipline

• Professional certifications such as CISSP, CISM, Microsoft Certified: Identity and Access Administrator, or TOGAF

• Background in risk‑based authentication, adaptive access, and identity analytics

• Experience in media, entertainment, or global enterprises

• Experience in cloud application development and maintenance

• Strong understanding of cloud security, container security, and zero trust architecture

• Experience deploying passwordless technology in a hybrid environment

• Knowledge of IAM‑related compliance frameworks such as SOX, GDPR, NIST, ISO 27001

Perks Playlist:

Join an entrepreneurial, global organization where authenticity, boldness, creativity, connection, drive, and insight aren’t just values—they’re how we work every day. Here are some of the ways we support you along the way (and just a few of the benefits we offer):

• Comprehensive medical, dental, and vision coverage

• Including 100% coverage for out‑patient in‑network mental health services

• Fertility coverage for eligible medical plan participants

• Wellbeing reimbursements for fitness classes, spa treatments, meal services, travel, and so much more (up to $720/year)

• Student Loan Repayment Assistance and Tuition Reimbursement

• 401(k) with 100% immediate vesting on the first 5% of your contributions, plus an additional UMG contribution

A variety of ways to prioritize much‑needed time away from work including:

• Flexible Paid Time Off (PTO) for exempt employees

• 3‑weeks PTO for non‑exempt employees

• 2‑weeks paid Winter Break

• 10 Company Holidays (including Juneteenth and Wellbeing Day)

• Summer Fridays (between Memorial Day and Labor Day)

• Generous paid parental leave for every type of parent

Check out our full overview of benefits on Perks Playlist page of the career site.

Disclaimer: This job description only provides an overview of job responsibilities that are subject to change.

Universal Music Group is an Equal Opportunity Employer

We are an E‑Verify employer in Alabama, Arizona, Georgia, Mississippi, North Carolina, South Carolina, Tennessee, and Utah.

Please note, UMG is not enrolled in E‑Verify in California and New York, and cannot support employment of candidates whose employer must enroll in E‑Verify, for example candidates on STEM‑OPT.

For more information, please click on the following links.

E‑Verify Participation Poster: English / Spanish

E‑Verify Right to Work Poster: English|Spanish

Job Category:
Technology

Salary Range:

$164,380 - $199,805

The actual base salary offered depends on a variety of factors, which may include, as applicable, the qualifications of the individual applicant for the position, years of relevant experience, specific and unique skills, level of education attained, certifications or other professional licenses held, and the location in which the applicant lives and/or from which they will be performing the job. All candidates are encouraged to apply.