Infrastructure Security and IAM Architect

Role Summary 

Designs the identity, access and infrastructure security architecture for a carve-out, covering the hybrid domain controller and Entra ID estate. Owns the target-state design and the technical approach for moving users, mailboxes and collaboration content. Re-architects only where the separation requires it. 

Job Responsibilities 

• Design the target identity architecture across on-premises Active Directory and Microsoft Entra ID 
  

• Define SSO, MFA, Conditional Access and privileged access models 
  

• Design directory synchronisation using Microsoft Entra Connect and tenant coexistence 
  

• Architect application sign-in and federation using SAML, OAuth 2.0 and OpenID Connect 
  

• Design network access authentication using RADIUS and 802.1X 
  

• Define infrastructure security controls: segmentation, firewalls, key and secrets management 
  

• Design landing zone security controls and guardrails across Azure and AWS 
  

• Select and configure migration tooling for user, mailbox, SharePoint and Teams moves 
  

• Produce high-level and low-level designs and review them with client architects 
  

• Define security logging requirements for identity and infrastructure events 
  

Required Experience 

• 10+ years of relevant experience in infrastructure and security architecture 
  

• 5+ years designing and implementing identity, including on-premises domain controller clusters 
  

• Strong understanding of Active Directory, Kerberos, LDAP and DNS 
  

• Strong understanding of Microsoft Entra ID and Entra Connect version 2 or above, including Entra Domain Services 
  

• Hands-on experience with SSO, MFA and Conditional Access 
  

• Experience with at least one third-party identity provider such as Okta or Ping Identity 
  

• 3+ years of experience with SAML and OAuth 2.0, plus OpenID Connect 
  

• Understanding of RADIUS-based authentication and 802.1X 
  

• Experience with migration tools such as BitTitan, Quest and AvePoint 
  

• Experience with mailbox, SharePoint, Teams and user migration 
  

• Experience with at least two cloud providers (Azure and AWS) 
  

• Experience designing and implementing landing zones with security controls and guardrails 
  

• Experience with Azure Key Vault or equivalent key management services 
  

• Experience designing colocation architectures 
  

• Deep understanding of hyper-converged infrastructure 
  

• Exposure to at least two OEMs or two cloud providers in each technology area 
  

• Strong communication skills, with prior experience working with UK and EU clients 
  

• Willingness to travel as required and to work in the client time zone 
  

• Prior infrastructure background alongside the specialism above 
  

• Prior experience in IT consolidations, mergers, demergers and carve-outs (mandatory) 
  

• Relevant professional certifications strongly recommended