Security Architect - Agentic Identity & Access Management

Security Architect - Agentic Identity & Access Management will define integrated authorization architecture and governance for artificial intelligence (AI) applications, agents, tools, application programming interfaces (APIs), human users, and other non-human identities. This architect will establish durable identity lifecycle and authorization capabilities, evaluate emerging technologies, and serve as a subject matter expert across cybersecurity, cloud, application security, AI engineering, governance, and enterprise architecture teams. 

Responsibilities: 

·       Define the enterprise target-state architecture and governance model for identities, delegated authority, and authorization across AI applications, agents, tools, APIs, and human users. 

·       Establish reusable authorization patterns for user-to-agent, agent-to-tool, machine-to-machine, and agent-to-agent interactions. 

·       Design policy enforcement approaches that support least privilege, Zero Standing Privilege (ZSP), separation of duties, context-aware access, runtime decisioning, and human-in-the-loop guardrails. 

·       Define lifecycle governance for AI agents and other non-human identities, including registration, sponsorship, ownership, credential issuance and rotation, recertification, suspension, deprovisioning, and evidence retention. 

·       Develop standards for OAuth 2.0, OpenID Connect (OIDC), token exchange, workload identity, delegated authorization, service accounts, and short-lived credentials. 

·       Evaluate vendor and native platform capabilities; document alternatives, tradeoffs, integration impacts, risks, and recommendations. 

·       Partner with Identity and Access Management (IAM), Identity Governance and Administration (IGA), Privileged Access Management (PAM), cloud security, application security, AI engineering, AI governance, enterprise architecture, and platform teams to align controls and operating responsibilities. 

·       Create reference architectures, design principles, control requirements, decision records, implementation roadmaps, and adoption guidance. 

·       Support solution reviews and threat-informed design decisions for AI use cases, Model Context Protocol (MCP) servers, agent tools, data access paths, and autonomous actions. 

·       Define logging, traceability, audit evidence, and monitoring requirements that connect each agent action to the agent identity, sponsoring owner, delegated user or system, authorization decision, and affected resource. 

·       Provide technical leadership and translate complex IAM and AI security concepts into clear decisions for engineers, product teams, leaders, and governance forums. 

·       Track relevant market and technology developments and recommend updates to architecture standards and strategic roadmaps. 

·       Perform other job duties as directed.

Qualifications: 

Required Qualifications 

·       High school diploma, General Educational Development (GED) credential, or equivalent education. 

·       College degree in technology, finance, business, or equivalent relevant work experience. 

·       Minimum 3 years of experience solving complex business or technical problems and driving multiple stakeholders toward implementable solutions.

·       Minimum 3 years of experience developing communication strategies that build stakeholder buy-in and acceptance. 

·       Minimum 3 years of experience working in a cross-functional technology environment. 

·       Deep expertise in enterprise IAM architecture and integration patterns for AI systems and agent-based environments. 

·       Experience designing OAuth 2.0 and OIDC flows for machine-to-machine and agent-to-agent communication. 

·       Strong hands-on knowledge of PAM, directory services such as Active Directory (AD), eDirectory, and Lightweight Directory Access Protocol (LDAP), workforce IAM, and Customer Identity and Access Management (CIAM) patterns. 

·       Experience with cloud-based IAM across Amazon Web Services (AWS), Microsoft Azure, or hybrid environments. 

·       Experience with secrets management, credential vaulting, identity lifecycle governance, authorization enforcement, auditability, and runtime governance. 

·       Strong communication, documentation, presentation, facilitation, negotiation, consensus-building, and cross-team collaboration skills, including the ability to translate complex IAM concepts for engineering and leadership audiences. 

·       Ability to lead stakeholders with conflicting priorities toward a recommendation, operate effectively amid changing priorities, and drive work to completion. 

·       Ability to comply with company attendance standards and meet any physical requirements associated with the role. 

Preferred Qualifications 

·       Five or more years of experience solving complex problems, developing communication strategies, and working in cross-functional technology environments. 

·       Two or more years of experience in the cybersecurity IAM domain. 

·       Experience with strategic and financial analysis, issue and risk management, project change requests, multiyear roadmaps, and executive-level communications. 

·       At least 1 year of experience working in a Scaled Agile Framework (SAFe) environment. 

·       Consulting experience. 

·       Familiarity with AI safety and governance frameworks, including the National Institute of Standards and Technology AI Risk Management Framework (NIST AI RMF) and the OWASP Top 10 for Large Language Model Applications. 

Tools and Technologies:  

·       AWS AgentCore and AWS Secrets Manager 

·       SailPoint Identity Security Cloud and SailPoint Entro Security 

·       Ping Identity Platform and Ping Agentic Identity and Access Management 

·       CyberArk, CyberArk CORA AI, BeyondTrust, and HashiCorp Vault 

·       Microsoft Foundry and Microsoft Entra ID 

·       CrowdStrike 

·       OAuth 2.0, OIDC, token exchange, workload identity, delegated authorization, service accounts, and short-lived credentials 

·       Active Directory, eDirectory, LDAP, workforce IAM, CIAM, PAM, IGA, Zero Trust, least privilege, and identity-first security patterns