IAM Architect

About Kinross

Role overview

Architecture leadership, security, and governance

• Own the enterprise IAM architecture and multi-year roadmap in alignment with security strategy, business priorities, and regulatory requirements.
• Define identity standards, design patterns, and reference architectures for directory services, authentication, authorization, identity governance, and privileged access.
• Lead architecture reviews, document decisions, and govern exceptions through the architecture review process.
• Mentor IAM administrators and review designs, code, and configurations.
• Engage stakeholders and vendors, including Microsoft and Saviynt, on product direction, evaluations, escalations, and licensing.
• Enforce identity security standards, hardening baselines, and Zero Trust principles across AD, Entra ID, and Saviynt.
• Support compliance and audit through access certification, logging, SoD and policy enforcement, and remediation of identity-related findings.
• Partner with security operations, infrastructure, DevOps/platform teams, HR, and application owners to apply identity standards across projects.

Directory services and hybrid identity

• Own Active Directory modernization and future-state architecture, including forest, domain, trust, and OU design, and the roadmap toward cloud-first identity.
• Define architecture and security baselines for on-premises Active Directory and Microsoft Entra ID, and guide engineers in operating and optimizing them.
• Design hybrid identity topology, including Entra Connect or Cloud Sync, password hash synchronization or pass-through authentication, federation, and seamless SSO.
• Design resilience and recovery for hybrid identity.
• Set authentication strategy and Conditional Access, including MFA, passwordless options such as Windows Hello for Business, FIDO2 keys, and passkeys, PIM, and Identity Protection.

Requirements

• Deep technical expertise in directory services, authentication protocols, identity governance, and automation.
• Ability to understand identity dependencies across infrastructure, cloud platforms, security controls, HR systems, and automations.
• Ability to evaluate enterprise-wide impacts of identity decisions and balance strategic architecture with hands-on expertise.
• Experience providing technical leadership and mentoring to IAM engineers or administrators.
• Ability to collaborate with HR, application owners, audit, vendors, security operations, infrastructure, and platform teams.
• Experience with Active Directory, Microsoft Entra ID, and enterprise identity governance platforms.