job summary:
Exciting opportunity to lead a growing team!
Our customer has an immediate need for a top-notch IAM Architect with excellent soft skills and consulting experience. This role will be client facing with some travel.
Remote with 15-25% travel within US. Must be able to work in US without sponsorship.
location: Telecommute
job type: Contract
salary: $75 - 100 per hour
work hours: 8am to 5pm
education: Bachelors
responsibilities:
Responsibilities:
- Designs and delivers the move of each acquired company's directories, tenants and access model onto the parent's Entra ID / M365 standard, while keeping users in both environments signing in and working until final cutover.
- Discover and map the acquired identity estate: AD forests and domains, tenants, federation, privileged accounts
- Design the target identity model, cross-tenant coexistence and the order of UPN and domain moves
- Plan the impact on SSO applications, devices and non-human identities (service accounts, service principals), and set the migration sequence
- Re-point SSO applications (SAML, OIDC, SCIM) and migrate non-human identities with least privilege
- Implement SOX access controls with the compliance team and retire the source environment at closeout
- Hands-on: configuration, scripting and cutover execution
- Lead a team of Engineers to deliver integrate IAM technologies and processes as part of complex acquisition integrations, often joining medium sized (typically private) companies into a publicly held enterprise environment (Fortune 200)
- Typically leading 1 acquisition integration at a time, although that may vary based on size and scope
- Own architecture through hands-on migration and cutover execution
- Own the domain end to end, including discovery, architecture, planning, risk, team leadership and execution
- Perform cutovers that may occur nights/weekends
- Architecture: assess an environment that is usually poorly documented, design the target state against the parent company's standards, and defend it in review with the program architects and the other domain leads
- Planning and risk: estimate effort, set the sequence and the dependencies other domains rely on, and define rollback and go/no-go criteria
- Leadership: direct a small team, coach the acquired company's IT staff, and work across security, compliance and application owners
- Repeatability: turn each deal into reference designs and runbooks so the next integration starts from the last one, and re-plan integrations that are already underway
qualifications:
Required Skills:
10+ years of Identity and Access Management experience
2+ years of recent experience as an Architect, Technical Lead, SME, and/or Lead Consultant
Deep Entra ID and Active Directory experience, including cross-tenant migrations
Strong SAML/OIDC/OAuth/SCIM, PowerShell, Python/Graph, DNS and PKI experience
Preferred Skills:
M&A integration experience
SC-300, Quest or similar migration tooling, AWS/Google Cloud Platform/OCI identity
Energy or heavy manufacturing/industrial experience
Consulting experience
Experience with SOX and other relevant compliance standards
skills:
IAM,soft skills,consulting experience
Equal Opportunity Employer: Race, Color, Religion, Sex, Sexual Orientation, Gender Identity, National Origin, Age, Genetic Information, Disability, Protected Veteran Status, or any other legally protected group status.
At Randstad Digital, we welcome people of all abilities and want to ensure that our hiring and interview process meets the needs of all applicants. If you require a reasonable accommodation to make your application or interview experience a great one, please contact
Pay offered to a successful candidate will be based on several factors including the candidate's education, work experience, work location, specific job duties, certifications, etc. In addition, Randstad Digital offers a comprehensive benefits package, including: medical, prescription, dental, vision, AD&D, and life insurance offerings, short-term disability, and a 401K plan (all benefits are based on eligibility).
This posting is open for thirty (30) days.
It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.
![]()
