Senior IDAM Architect – Identity Pillar

Senior IDAM Architect Identity Pillar (Lot 1)
Location Coventry UK

Role Purpose

The Senior IDAM Architect is the ** end to end technical authority for all Identity Pillar scope under Lot 1** accountable for Initiate Discovery Design and Implementation across Identity Governance & Administration (IGA) Active Directory/Entra ID RBAC/ABAC PKI Conditional Access Identity Lifecycle CIEM and identity threat protection capabilities.

This role acts as the single technical point of contact for all identity related decisions integrations designs and technical escalations ensuring adherence to Zero Trust principles Client Delivery & Cyber frameworks and the architectural governance process.

Key Responsibilities

1. Programme-Level Identity Architecture Leadership

Serve as the lead architect for all identity capabilities: IGA directories (AD/OT AD/Entra ID) RBAC/ABAC Conditional Access PKI CIEM machine identity identity lifecycle automation.

Own the architectural strategy and roadmap for the Identity Pillar across Year 1 (I&D) and influence Year 2 planning.

Act as the single technical authority across all identity workstreams ensuring coherence interoperability and alignment with Zero Trust Identity outcomes.

Lead technical governance engagement: Information Security TAG PESA approvals Design Authority reviews and cross pillar integration sessions.

2. Initiate & Discovery Responsibilities (Identity Specific)

Lead comprehensive DAAS discovery for identity components:

o identity stores and directories

o AD forests/domains and OT AD footprint

o application identity models

o entitlements access patterns privileged roles

o IGA process and connector readiness

o non human / service identities

Conduct identity specific discovery across:

o JML processes access request flows attestation cycles

o directory security posture (CIS benchmarks Microsoft best practices)

o account discovery (human service machine) across IT OT cloud SaaS air gapped systems

Evaluate and document:

o identity risks

o excessive privileges

o identity lifecycle issues

o unmanaged accounts

o access policy gaps

Produce:

o discovery logs

o dependency registers

o technical constraints

o discovery outputs traceable to future designs

3. Identity Architecture Design Responsibilities

IGA Architecture

Produce HL/ML/LLD for the IGA platform (SailPoint/Saviynt/etc.).

Define architecture for:

o lifecycle automation (Joiner/Mover/Leaver)

o access request & approval workflows

o entitlements management

o attestation & certification

o role mining & identity analytics

Define integration patterns with:

o HR (authoritative source)

o AD/OT AD/Entra ID

o ServiceNow

o SIEM for identity related detections

o PAM/PIM for privileged identities

Directory Services & Identity Core

Produce architecture for AD Entra ID and OT AD identity capabilities:

o secure configuration baselines

o naming conventions OU design GPO strategy

o trust boundaries domain/forest design

o identity lifecycle & sync patterns

o directory-tiering strategy (Tier 0)

RBAC / ABAC

Define enterprise RBAC/ABAC models:

o business roles

o application roles

o segregation of duties

o governance and lifecycle of roles

Ensure alignment with HR data models and IGA role mining outputs.

Conditional Access & Authentication

Architect conditional access policies (CA rules sign in risk device trust session controls).

Define MFA strategy: Authenticator App FIDO2 passwordless biometrics.

Define Zero Trust authentication patterns for:

o privileged identities

o third parties

o mobile/remote users

o OT identities where applicable

PKI & Certificate Lifecycle

Produce architecture for PKI certificate issuance renewal and lifecycle governance.

Define trust anchors and certificate policies for:

o user identities

o device identities

o service principals

o OT and cloud workloads

CIEM (Cloud Infrastructure Entitlement Management)

Define cloud identity entitlement patterns (Azure/AWS).

Establish least privilege JIT/JEA patterns for cloud workloads.

4. Implementation Responsibilities (Identity-Focused)

Provide hands on architectural oversight to ensure implementations follow approved designs.

Oversee rollout and validation of:

o IGA connectors workflows lifecycle processes

o AD/Entra ID configuration updates and hardening

o Conditional access/MFA/policy rollout

o RBAC role deployment and attestation setup

o PKI enhancements CA templates certificate workflows

o CIEM configuration and governance

Guide identity engineers and application onboarding teams through technical sequencing integration steps and issue resolution.

Validate end to end identity flows (authentication provisioning deprovisioning attestation).

5. Identity Governance Compliance & Risk

Ensure all identity designs align with:

o Zero Trust Identity requirements

o CAF/eCAF outcomes

o regulatory and compliance frameworks (GDPR NIS R PCI DSS)

Define governance processes for:

o privileged identity control

o identity data quality

o access attestation

o policy exceptions

Support the audit and compliance teams with identity reporting evidence and control design.

6. Stakeholder & Technical Leadership

Act as the single point of contact for all identity related technical matters across the programme.

Lead communication with:

o Cyber Architecture

o HR IT Ops Security Operations

o Application teams

o OT Identity & OT Engineering teams

Conduct design walkthroughs knowledge handovers and training sessions for BAU teams.

Resolve identity related escalations engineering blockers and architecture decision disputes.

Skills & Experience Requirements (Identity Scope)

Technical Expertise

12 years in Identity & Access Management architecture.

Deep expertise in:

o IGA (SailPoint/Saviynt) RBAC/ABAC

o AD/Entra ID/OT AD

o Authentication/Federation (SAML OAuth2 OIDC)

o Conditional Access & MFA

o PKI & Certificate Lifecycle

o CIEM cloud identity & Zero Trust identity patterns

Extensive experience designing and integrating identity capabilities across hybrid (IT/OT) landscapes.

Delivery & Architecture

Proven experience delivering large-scale IAM transformations end to end.

Strong architectural documentation and governance skills.

Ability to lead multi vendor and multi platform identity delivery teams.

Behavioural

Executive-level communication and architectural leadership.

Operates confidently across strategic detailed technical and operational domains.

Structured methodical collaborative and outcome driven.

Key Deliverables

Identity DAAS Discovery Reports

Requirements (Functional & Non Functional)

High/Mid/Low-Level Identity Designs

IGA Architecture Connector Designs & Workflow Specifications

Directory Services Architecture Pack

RBAC/ABAC Role Taxonomy & Governance Framework

Conditional Access & MFA Design Pack

PKI Architecture & Lifecycle Model

Identity Implementation Playbooks

Governance Controls & Attestation Designs

Technical submissions for TAG/PESA/Design Authority