Contract

IAM Security Architect

Ref: BBBH67581_1785484591

Hybrid-remote in London

Whitehall Resources are looking for an IAM Security Architect. This role is hybrid working for an initial 6 month contract.

***Inside IR35***

Job Purpose
The Identity & Access Architect is responsible for defining, designing, and governing enterprise-wide Identity and Access Management (IAM) solutions across Microsoft Azure, Microsoft Entra ID, Google Cloud Platform (GCP) and Saas Platform such as Salesforce, Oracle Health Insurance , and PeopleSoft.
The role provides technical leadership for identity architecture, authentication, authorization, privileged access management, federation, secrets management, token lifecycle governance, and DevSecOps identity controls. The architect will establish secure, scalable, and compliant identity patterns for users, applications, workloads, APIs, automation platforms, and CI/CD pipelines while supporting a Zero Trust security model.
The successful candidate will serve as the subject matter expert for cloud identity, access governance, workload authentication, and token management across hybrid and multi-cloud environments for human and also agentic access requirements.

Key Responsibilities

Identity Architecture & Strategy:

Define and maintain the enterprise IAM strategy and roadmap.
Design secure identity architectures across Azure, Entra ID, GCP , SaaS platform
Design User access management for human, Agentic applications and API’s
Develop identity governance standards, patterns, and reference architectures.
Ensure alignment with Zero Trust principles and cloud security best practices.
Lead the design of hybrid identity and cloud-native authentication solutions.
Provide architecture guidance for new applications, platforms, and services.

Authentication & Federation:
Design and implement enterprise authentication and federation services including:

Single Sign-On (SSO)
Multi-Factor Authentication (MFA)
Passwordless Authentication
Federation Services
Identity Trust Relationships

Protocols and technologies:

SAML 2.0
OAuth 2.0
OpenID Connect (OIDC)
SCIM
WS-Federation
Kerberos
LDAP

Responsibilities include:

Federation between Microsoft Entra ID and GCP.
Integration with SaaS and third-party identity providers.
B2B and B2C identity solutions.
Cross-cloud trust establishment.
API authentication architecture.

Token Management & Governance:
Act as the enterprise authority for token lifecycle management.
Token Types

OAuth Access Tokens
Refresh Tokens
ID Tokens
JWT Tokens
Service Account Tokens
OIDC Tokens
PAT (Personal Access Tokens)
API Access Tokens

Responsibilities

Define token issuance standards.
Establish token lifespan and expiry policies.
Design token validation mechanisms.
Define token revocation processes.
Implement token monitoring and auditing.
Govern token signing and certificate management.
Design secure token storage patterns.
Prevent token leakage and abuse.
Establish short-lived token standards across cloud platforms.

Security Principles

Least privilege access
Just-In-Time (JIT) authentication
Zero Trust verification
Secure token handling
Continuous validation of identity

Secrets, Certificates & Key Management:
Design and govern enterprise secret management capabilities.
Microsoft Azure

Azure Key Vault
Managed Identities
Entra Workload Identities
Service Principals
Certificate Management

Google Cloud Platform

Secret Manager
Cloud KMS
Customer Managed Encryption Keys (CMEK)
Workload Identity Federation
Service Accounts

Responsibilities

Credential lifecycle management.
Automated secret rotation.
Certificate lifecycle governance.
Encryption key management.
Elimination of hard-coded credentials.
Secure storage and retrieval controls.
Auditable access to sensitive credentials.
Secrets management standards across cloud platforms.

Privileged Access Management (PAM):
Design and govern privileged access solutions including:

Microsoft Entra Privileged Identity Management (PIM)
Just-In-Time Access
Just Enough Administration (JEA)
Google Cloud IAM Controls

Responsibilities include:

Privileged role governance.
Privileged access reviews.
Break-glass account management.
Segregation of duties controls.

All of our opportunities require that applicants are eligible to work in the specified country/location, unless otherwise stated in the job description.

Whitehall Resources are an equal opportunities employer who value a diverse and inclusive working environment. All qualified applicants will receive consideration for employment without regard to race, religion, gender identity or expression, sexual orientation, national origin, pregnancy, disability, age, veteran status, or other characteristics.