IAM Architect

IAM Architect Posting Date: 10/22/26 Location: Toronto, ON, CAN, Job Summary The IAM Architect is accountable for the architecture, strategy, and design of the organization's identity ecosystem, with primary ownership of the target-state architecture for Active Directory (AD), Microsoft Entra ID (formerly Azure AD), and the enterprise Identity Governance and Administration (IGA) platform. Sitting within the Enterprise Cyber team in IT, the Architect defines identity standards, reference architectures, and the multi-year IAM roadmap, provides technical leadership and mentoring to IAM engineers, and serves as the design authority for identity governance, hybrid identity, access management, Microsoft identity licensing, and identity data quality. As automation and AI take on routine identity tasks, the Architect shapes the organization's identity fabric, ensuring security, resilience, interoperability, and compliance across hybrid and multi-cloud environments. The successful candidate combines deep technical credibility with architectural judgment: the ability to understand identity dependencies across infrastructure, cloud platforms, security controls, HR systems, and automations, and to evaluate the enterprise-wide impact of identity decisions. They will balance strategic architecture and governance with hands-on expertise in directory services, authentication protocols, identity governance, and automation, and will lead the cross-functional collaboration with HR, application owners, audit, and vendors needed to secure an increasingly autonomous, AI-driven enterprise. Key Responsibilities Architecture Leadership, Security & Governance • Own the enterprise IAM architecture and multi-year roadmap, aligning identity capabilities with Enterprise Cyber strategy, business priorities, and regulatory requirements. • Define and maintain identity standards, design patterns, and reference architectures for directory services, authentication, authorization, identity governance, and privileged access. • Act as the design authority for identity solutions: lead architecture reviews, document architecture decisions, and govern exceptions through the established architecture review process. • Provide technical leadership and mentoring to IAM administrators, reviewing designs, code, and configurations and raising overall team capability. • Engage stakeholders and vendors (including Microsoft and Saviynt) on product direction, solution evaluations, escalations, and commercial and licensing discussions. • Define and enforce identity security standards, hardening baselines, and Zero Trust principles across AD, Entra ID, and Saviynt. • Support compliance, audit, and regulatory requirements through access certification, logging, SoD and policy enforcement, and own remediation of identity-related audit findings. • Partner with security operations, infrastructure, DevOps/platform teams, HR, and application owners to embed identity standards and architecture review into projects across the enterprise. Directory Services, Hybrid Identity & Microsoft Licensing • Own Active Directory modernization, transformation, and future-state architecture, including forest, domain, trust, and OU design and the roadmap toward cloud-first identity in Microsoft Entra ID. • Define the architecture and security baselines for on-premises Active Directory (domains, forests, trusts, Group Policy, DNS, sites & services) and Microsoft Entra ID, and guide engineers in operating and optimizing them. • Design the hybrid identity architecture: Entra Connect / Cloud Sync topology, password hash sync / pass-through authentication, federation, and seamless SSO, including resilience and recovery design. • Set the authentication strategy and Conditional Access framework, including MFA, passwordless authentication (e.g., Windows Hello for Business, FIDO2 security keys, passkeys), Privileged Identity Management (PIM), and Identity Protection. • Design and enforce a tiered administration model for AD and Entra ID (Tier 0/1/2, privileged access workstations, and protected admin accounts) to protect privileged identities. • Lead AD hygiene and modernization, including Group Policy rationalization, OU and delegation clean-up, remediation of legacy protocols and stale objects, and reduction of on-premises dependencies. • Own Microsoft 365 and Entra ID license management for identity services, including Microsoft 365 and Entra ID Governance entitlements. • Design group-based licensing and automate license assignment and removal through the identity lifecycle, so licenses follow joiner/mover/leaver events, role, and employee type. • Monitor license utilization, reclaim unused or misassigned licenses, and resolve assignment errors and conflicts. • Produce licensing reports and cost-optimization recommendations, and support renewals, true-ups, and compliance reviews with Procurement and Microsoft. Identity Governance & Administration (IGA) and Identity Data Quality • Identity Governance & Administration (IGA) and Identity Data Quality • Own the architecture of the enterprise IGA platform (Saviynt), including connectors, workflows, and integrations with AD, Entra ID, the HR system of record, and downstream applications, and direct its continuous improvement. • Design the end-to-end identity lifecycle with HR as the authoritative source of truth, covering joiner/mover/leaver processes, provisioning and deprovisioning, and contractor and non-employee identities, orchestrated through Saviynt and Entra ID. • Design the access governance model: role-based access control (RBAC) and role models, entitlement catalogs, access certification and recertification campaigns, and segregation-of-duties (SoD) rules. • Define birthright access, access request and approval workflows, and policy-driven provisioning rules, and ensure they are implemented consistently across platforms. • Partner with audit, compliance, and application owners to design governance controls that meet regulatory and internal requirements, IT general controls, and ensure audit evidence is complete and repeatable. • Architect Microsoft Entra ID Governance capabilities (access reviews, entitlement management and access packages, lifecycle workflows, and PIM for roles and groups) and define how they complement Saviynt. • Design privileged access governance, including just-in-time elevation, approval and periodic review of privileged roles, and break-glass account controls. • Define identity data quality standards and attribute governance, including data ownership, authoritative sources, and HR-to-AD, Entra ID, and Saviynt attribute mapping. • Detect and remediate orphaned, duplicate, and stale accounts and inconsistent attributes (e.g., manager, department, location, employee type) through automated reconciliation. • Establish identity data quality reporting and KPIs, and partner with HR and data owners to correct issues at the source and prevent recurrence. Authentication, Authorization & Integration • Define standards and patterns for SSO and application onboarding across SAML, OIDC, OAuth 2.0, and SCIM provisioning, and guide engineers through complex integrations. • Design the integration of enterprise applications with Entra ID, AD, and Saviynt, and set governance for service principals, enterprise apps, app registrations, and API permissions. • Define the governance model for machine and workload identities (service accounts, API keys, certificates, and secrets), with appropriate rotation and least-privilege controls. • Automation, Resilience & AI Oversight • Set the automation strategy and standards (PowerShell, Microsoft Graph API, Saviynt connectors and APIs, infrastructure-as-code) and oversee automation of identity lifecycle, licensing, and data quality workflows. • Direct the use of AI and automation for routine identity and governance tasks while maintaining human oversight, validating AI-generated configurations and code, and intervening where nuanced judgment is required. • Define resilience requirements for identity systems, lead resilience and chaos testing (e.g., directory outage, MFA bypass scenarios), and lead root-cause analysis and post-incident improvements. Required Technical Skills • Active Directory: Deep expertise in forest, domain, trust, and OU design, Group Policy, DNS, replication, FSMO roles, tiered administration, AD security hardening, hygiene, and recovery. • Microsoft Entra ID: Conditional Access, MFA and passwordless authentication, PIM, Identity Protection, Entra ID Governance, app registrations, enterprise applications, dynamic groups, and group-based licensing; working knowledge of Microsoft 365 and Entra ID licensing (E3/E5, Entra ID P1/P2, Entra ID Governance). • Identity Governance & Administration: Proven experience architecting and integrating an enterprise IGA platform, ideally Saviynt (or SailPoint, One Identity, or equivalent), including connectors, lifecycle workflows, access certifications, RBAC, SoD controls, HR-driven provisioning, and identity attribute mapping and reconciliation; familiarity with Microsoft Entra ID Governance (access reviews, entitlement management, lifecycle workflows). • Hybrid Identity: Entra Connect / Cloud Sync topology design, federation (AD FS or third-party), hybrid join scenarios, and migration toward cloud-first identity. • Protocols: Strong working knowledge of SAML, OIDC, OAuth 2.0, SCIM, Kerberos, and LDAP - including the ability to troubleshoot complex integration failures. • Automation & Scripting: PowerShell (advanced), Microsoft Graph API, Saviynt connector and API integration, and infrastructure-as-code (e.g., Terraform), applied to lifecycle, licensing, and reconciliation automation. • Security & Architecture: Zero Trust, least privilege, privileged access management, and identity threat detection, together with architecture practices such as reference architectures, design standards, and architecture decision records. • Emerging / AI-era skills (preferred): AI agent and workload identity governance, human-AI orchestration, identity data modeling, and validation of AI-generated identity configurations. Required Soft Skills • Strategic judgment - ability to make sound decisions in high-stakes, ambiguous, and non-routine identity scenarios that automation cannot resolve. • Cross-functional influence & collaboration - works effectively across security, DevOps, HR, compliance, audit, and application teams; influences senior stakeholders and vendors and translates technical identity concepts for non-technical audiences. • Problem-solving & root-cause analysis - strong analytical and troubleshooting skills, especially under incident pressure. • Critical Thinking - Analyzes information objectively, challenges assumptions, and makes well-reasoned decisions based on evidence and sound judgment. • Design Thinking - Applies a human-centered, creative approach to understand problems, generate innovative solutions, and design identity experiences that are both secure and easy to use. • Communication - clear written and verbal communication, including architecture documentation, roadmaps, and executive-level stakeholder engagement. • Adaptability & continuous learning - thrives in a rapidly changing environment; embraces upskilling and AI fluency as the role evolves. • Leadership, ownership & accountability - mentors and develops administrators, sets quality standards, exercises autonomy, anticipates risk, and follows through on outcomes. • Ethical reasoning - applies sound judgment to access, trust, and governance decisions in an AI-driven enterprise. Qualifications and Skills • Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or equivalent experience. • 10+ years of experience in identity and access management, including deep hands-on experience with Active Directory and Microsoft Entra ID in enterprise/hybrid environments and recent experience in an IAM architecture or technical lead role. • Demonstrated experience designing and implementing an enterprise IGA platform (Saviynt preferred; SailPoint or equivalent considered), including HR-driven lifecycle integration. • Track record of owning identity architecture and roadmaps, leading complex hybrid identity or Active Directory modernization initiatives, and mentoring engineers. • Experience managing Microsoft 365 and Entra ID licensing at enterprise scale and leading identity data quality or reconciliation programs. • Experience working in regulated or audited environments (e.g., SOX-type controls, SoD) and engaging with auditors, vendors, and senior stakeholders. • Relevant certifications preferred: Microsoft Certified: Identity and Access Administrator Associate (SC-300), CISSP, or an equivalent certification is an asset. Compensation and Total Rewards The base salary range for this role is $130,000 to $160,000 CAD plus a targe