Senior Identity and Access Management Architect

Kforce has a client in Fort Lauderdale, FL that is seeking a Senior Identity and Access Management Architect. Summary: Our client is seeking a Senior Identity and Access Management Architect to assess, modernize, and improve its user provisioning environment. The Architect will design secure, scalable, and reliable identity lifecycle processes across Workday, Banner, Active Directory, Microsoft Entra ID, OneLogin, and downstream applications. This role requires strong hands-on provisioning expertise to establish authoritative identity sources, automate joiner/mover/leaver processes, support employee and student identities, including dual affiliations, and implement monitoring, reconciliation, error handling, and deprovisioning safeguards. The Architect will define the target-state IAM architecture, create a phased modernization roadmap, and guide implementation according to modern IAM, security, governance, and least-privilege practices.

Requirements:

• 8+ years of enterprise IAM experience, with significant responsibility for identity architecture and user-provisioning design
• Proven ability to assess an existing provisioning environment and design a modern, scalable target-state architecture
• Expert knowledge of end-to-end user provisioning across HR/SIS systems, identity platforms, directories, and downstream applications
• Experience designing joiner, mover, leaver, rehire, return, and deprovisioning processes
• Experience handling complex identity scenarios, including employee/student dual affiliations, duplicate identities, role changes, and multiple source records
• Experience establishing authoritative identity sources and ownership rules for critical identity attributes
• Strong experience integrating Workday, Banner, or comparable HRIS, SIS, and ERP platforms with IAM systems
• Expert knowledge of Microsoft Entra ID, Active Directory, Entra Connect, Cloud Sync, and cross-tenant synchronization
• Experience designing automated provisioning using SCIM, APIs, Microsoft Graph, PowerShell, SQL, file-based integrations, and middleware
• Experience implementing provisioning safeguards, including reconciliation, validation, approval gates, retry processing, error handling, rollback, and mass-deletion protection
• Ability to design monitoring and alerting for failed provisioning, synchronization issues, duplicate identifiers, stale accounts, and incomplete lifecycle events
• Experience defining modern access-assignment models using roles, groups, attributes, access packages, and least-privilege principles
• Strong understanding of authentication, provisioning, authorization, and identity governance as separate but connected functions
• Expertise with SAML, OIDC/OAuth, SCIM, LDAP, and Kerberos
• Experience modernizing legacy IAM platforms, custom scripts, databases, manual workflows, and duplicated provisioning logic