Principal IAM/PAM Security Architect

Overview

We are representing a confidential healthcare technology organization seeking a Principal IAM/PAM Security Architect to define and evolve security architecture for identity and privileged access across a large, complex, multi-domain environment. This role sets security standards for identity platforms, leads the definition of emerging Agentic Identity standards for AI agents and other non-human identities, drives implementation of enterprise PAM solutions, and owns secrets governance enterprise-wide. You'll partner closely with identity, cloud, and application teams to keep controls consistent, auditable, and scalable.

Responsibilities

• Identity Architecture & Standards: Define and maintain security architecture and standards across Active Directory, Microsoft Entra ID, Okta, and multi-cloud identity (AWS, Azure, GCP, OCI), covering authentication, authorization, and lifecycle controls
• Serve as the architectural authority for identity security decisions, aligning platform and cloud teams to enterprise standards across a large, complex identity environment
• Lead architecture reviews and risk assessments for new identity integrations, platform migrations, and M&A activity
• Agentic Identity Standards: Define enterprise standards for Agentic Identity—governance, lifecycle, authentication, and authorization for AI agents and other non-human identities, including provisioning, scoped entitlements, and deprovisioning
• Track the evolving agentic AI and non-human identity landscape and advise leadership on emerging risks, standards, and vendor capabilities
• Privileged Access Management: Define security requirements for and lead enterprise-wide implementation of PAM platforms, including Secret Server and Privilege Manager
• Design privileged access controls—least privilege, JIT/JEA, session monitoring, credential rotation—across on-premises and cloud environments
• Produce audit-ready evidence of PAM controls aligned to frameworks such as SOX, HIPAA, PCI, and ISO 27001
• Secrets Governance: Own enterprise policy and lifecycle standards for all secrets—API keys, OAuth/OATH tokens, service account credentials, and certificates—including vaulting, rotation, and secure distribution
• Drive detection and remediation of hardcoded, unmanaged, or leaked secrets across source code, configuration, and CI/CD pipelines
• Establish metrics and reporting to track secrets governance maturity and compliance across the organization
• Governance & Collaboration: Participate in and help lead architecture review boards, governance forums, and risk committees for identity and privileged access
• Maintain reference architectures, standards documentation, and roadmaps for identity, PAM, and secrets governance
• Advise stakeholders on identity risk and control design for new initiatives, and mentor engineers implementing identity, PAM, and secrets solutions

What We're Looking For

• Bachelor's degree in a technology discipline or equivalent professional experience
• 8+ years of experience in identity and access management, privileged access management, or security architecture roles, including experience across large, complex enterprise environments
• Demonstrated experience designing security standards across hybrid identity environments (Active Directory, cloud IAM, and SaaS identity providers)
• Hands-on experience with PAM platforms (Delinea preferred) at an architecture or lead engineering level
• Enterprise Identity Platforms: Active Directory (multi-domain/forest architectures), Microsoft Entra ID, and Okta, including federation, conditional access, and hybrid identity synchronization
• Cloud IAM: Identity and access models across AWS, Azure, GCP, and OCI, including IAM roles/policies, workload identity, federation, and cross-cloud access patterns
• Agentic & Non-Human Identity: AI agent architectures, service/workload identities, and emerging standards for non-human identity governance
• PAM & Secrets Management: Hands-on experience with Secret Server and Privilege Manager, plus broader vaulting technologies (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager) and secrets-detection tooling
• Authentication & Authorization Protocols: Kerberos/NTLM, LDAP/LDAPS, SAML/OIDC, OAuth 2.0, RADIUS/TACACS+, PKI/certificates, and MFA
• Security & Compliance Frameworks: SOX, HIPAA, PCI DSS, and ISO 27001 as applied to identity, privileged access, and secrets controls
• Automation & DevOps Integration: PowerShell, Python, and REST APIs for identity/PAM/secrets lifecycle automation; experience embedding these controls into CI/CD pipelines and infrastructure-as-code (Terraform, ARM, CloudFormation)
• Strong analytical and architectural problem-solving skills, with the ability to translate complex, multi-domain identity environments into clear standards
• Excellent communication skills to convey architecture and risk decisions to technical and business stakeholders
• Relevant security certifications preferred (CISSP, CISM, SABSA, CCSP)

How We Work with You

When you apply through Get A Job.ai, our talent team will conduct an initial screening to understand your background, experience, and career goals. We will then present qualified candidates to our client for consideration. Throughout the process, we serve as your advocate and point of contact. Please do not contact the client organization directly, as all communication should flow through our recruiting team to ensure a coordinated and professional hiring experience.

Pay

Pay via Get A Job.ai will be competitive and commensurate with experience. Our client offers a comprehensive benefits package including medical, dental, vision, disability and life insurance coverage, 401(k) savings plans, paid family leave, paid holidays, and generous paid time off.

Equal Employment Opportunity: Get A Job.ai is committed to fostering an inclusive hiring process. We evaluate all qualified applicants without regard to race, color, religion, sex, national origin, disability status, protected veteran status, or any other characteristic protected by law.