IAM Solution Architect (Contract | Madison, WI or Remote)

Position Summary

We are seeking an experienced, hands-on Senior IAM Solution Architect to provide architecture and technical leadership for a critical enterprise environment-separation initiative.

The role will focus on rapidly evaluating the existing IAM environment, identifying architectural and integration gaps, and developing practical, implementation-ready solutions. The architect will work extensively across Microsoft Active Directory, Microsoft Entra ID, hybrid identity, application access, authentication, authorization, and identity security controls.

This is an execution-focused technical architecture role, rather than a general IAM advisory, assessment-only, or project management position.

Key Responsibilities: IAM Architecture & Solution Design

• Assess current IAM architectures, integrations, configurations, dependencies, and future-state access patterns.
• Identify architectural gaps, security risks, and technical constraints.
• Design practical current-state, transitional, and target-state IAM solutions.
• Evaluate identity trust boundaries, authentication methods, directory dependencies, authorization models, and cross-environment access.
• Produce implementation-ready architecture and technical documentation.

• Analyze and troubleshoot AD and Entra ID environments.
• Design and validate security groups, nested groups, entitlement mappings, and group-based application assignments.
• Evaluate hybrid identity synchronization and authentication flows.
• Address directory trusts and dependencies between separated environments.
• Troubleshoot authentication, authorization, identity integration, and group membership issues.

• Partner with application owners, business stakeholders, cloud teams, infrastructure engineers, and cybersecurity personnel.
• Translate application and business access requirements into IAM solutions.
• Resolve identity issues involving users, applications, administrators, service accounts, and system integrations.
• Facilitate technical sessions to resolve migration blockers.

• Design solutions involving SSO, federation, MFA, Conditional Access, privileged access, and identity lifecycle management.
• Evaluate provisioning/deprovisioning and joiner/mover/leaver requirements.
• Address service accounts, machine identities, workload authentication, legacy authentication, and emergency access.
• Develop controls to prevent inappropriate cross-environment access.

• Identify identity-related migration dependencies and sequencing requirements.
• Develop IAM migration guidance and integration specifications.
• Create cutover, access-validation, and rollback procedures.
• Support mock go-live exercises, troubleshooting, testing, and defect remediation.
• Support production cutover and post-cutover stabilization.

• Extensive professional experience with enterprise Identity and Access Management.
• Senior/principal-level IAM engineering or solution architecture experience.
• Strong hands-on expertise with Microsoft Active Directory and Microsoft Entra ID.
• Deep knowledge of:
• AD security groups and nested groups
• Identity synchronization
• Group-based application access
• Authentication and authorization
• Hybrid identity architectures
• Experience with SSO, federation, MFA, Conditional Access, privileged access, and identity lifecycle management.
• Experience supporting complex application or infrastructure migrations, environment separations, or enterprise transformation programs.
• Ability to troubleshoot IAM issues spanning users, groups, applications, infrastructure, service identities, and directories.
• Experience producing architecture diagrams, technical designs, migration procedures, testing requirements, and cutover documentation.
• Ability to operate independently and deliver under aggressive deadlines.

• Experience with enterprise environment segmentation or separation.
• Multiple AD domain or Entra tenant experience.
• Complex application entitlement mapping experience.
• Experience in healthcare, government contracting, or another regulated environment.
• Understanding of Zero Trust Architecture.
• Production migration rehearsal, cutover, and stabilization experience.