Identity Architect (Domain Lead)_ W2

Title: Identity Architect (Domain Lead): Location: Remote

Leads 2-3 engineers.

Designs and delivers the move of each acquired company's directories, tenants and access model onto the parent's Entra ID / M365 standard, while keeping users in both environments signing in and working until final cutover.

• Discover and map the acquired identity estate: AD forests and domains, tenants, federation, privileged accounts
• Design the target identity model, cross-tenant coexistence and the order of UPN and domain moves
• Plan the impact on SSO applications, devices and non-human identities (service accounts, service principals), and set the migration sequence
• Re-point SSO applications (SAML, OIDC, SCIM) and migrate non-human identities with least privilege
• Implement SOX access controls with the compliance team and retire the source environment at closeout
• Hands-on: configuration, scripting and cutover execution

Must have:

[8+] years of identity and access management, with design ownership on cross-tenant migrations; deep Entra ID (Conditional Access, SSO, MFA, Entra Connect) and Active Directory; SAML/OIDC/OAuth/SCIM and claims mapping; PowerShell, Python and Graph; DNS and PKI.

Nice to have:

SC-300, Quest or similar migration tooling, AWS/Google Cloud Platform/OCI identity.