Senior Identity and Access Management Architect

Responsibilities

Kforce has a client in Fort Lauderdale, FL that is seeking a Senior Identity and Access Management Architect. Summary: Our client is seeking a Senior Identity and Access Management Architect to assess, modernize, and improve its user provisioning environment. The Architect will design secure, scalable, and reliable identity lifecycle processes across Workday, Banner, Active Directory, Microsoft Entra ID, OneLogin, and downstream applications. This role requires strong hands-on provisioning expertise to establish authoritative identity sources, automate joiner/mover/leaver processes, support employee and student identities, including dual affiliations, and implement monitoring, reconciliation, error handling, and deprovisioning safeguards. The Architect will define the target-state IAM architecture, create a phased modernization roadmap, and guide implementation according to modern IAM, security, governance, and least-privilege practices.

Requirements

• 8+ years of enterprise IAM experience, with significant responsibility for identity architecture and user-provisioning design
• Proven ability to assess an existing provisioning environment and design a modern, scalable target-state architecture
• Expert knowledge of end-to-end user provisioning across HR/SIS systems, identity platforms, directories, and downstream applications
• Experience designing joiner, mover, leaver, rehire, return, and deprovisioning processes
• Experience handling complex identity scenarios, including employee/student dual affiliations, duplicate identities, role changes, and multiple source records
• Experience establishing authoritative identity sources and ownership rules for critical identity attributes
• Strong experience integrating Workday, Banner, or comparable HRIS, SIS, and ERP platforms with IAM systems
• Expert knowledge of Microsoft Entra ID, Active Directory, Entra Connect, Cloud Sync, and cross-tenant synchronization
• Experience designing automated provisioning using SCIM, APIs, Microsoft Graph, PowerShell, SQL, file-based integrations, and middleware
• Experience implementing provisioning safeguards, including reconciliation, validation, approval gates, retry processing, error handling, rollback, and mass-deletion protection
• Ability to design monitoring and alerting for failed provisioning, synchronization issues, duplicate identifiers, stale accounts, and incomplete lifecycle events
• Experience defining modern access-assignment models using roles, groups, attributes, access packages, and least-privilege principles
• Strong understanding of authentication, provisioning, authorization, and identity governance as separate but connected functions
• Expertise with SAML, OIDC/OAuth, SCIM, LDAP, and Kerberos
• Experience modernizing legacy IAM platforms, custom scripts, databases, manual workflows, and duplicated provisioning logic

The pay range is the lowest to highest compensation we reasonably in good faith believe we would pay at posting for this role. We may ultimately pay more or less than this range. Employee pay is based on factors like relevant education, qualifications, certifications, experience, skills, seniority, location, performance, union contract and business needs. This range may be modified in the future.

We offer comprehensive benefits including medical/dental/vision insurance, HSA, FSA, 401(k), and life, disability & ADD insurance to eligible employees. Salaried personnel receive paid time off. Hourly employees are not eligible for paid time off unless required by law. Hourly employees on a Service Contract Act project are eligible for paid sick leave.

Note: Pay is not considered compensation until it is earned, vested and determinable. The amount and availability of any compensation remains in Kforce's sole discretion unless and until paid and may be modified in its discretion consistent with the law.

This job is not eligible for bonuses, incentives or commissions.

Kforce is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status, or disability status.

By clicking “Apply Today” you agree to receive calls, AI-generated calls, text messages or emails from Kforce and its affiliates, and service providers. Note that if you choose to communicate with Kforce via text messaging the frequency may vary, and message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You will always have the right to cease communicating via text by using key words such as STOP.