Senior IDAM Architect – Identity Pillar

Coventry, United Kingdom | Posted on 10/05/2026

Senior IDAM Architect – Identity Pillar(Lot
1)

Location – Coventry, UK

The Senior IDAM Architect is the end toend technical authority for all Identity Pillar scope under Lot 1,accountable for Initiate, Discovery, Design, and Implementation across Identity Governance & Administration (IGA), Active Directory/Entra , RBAC/ABAC,PKI, Conditional Access, Identity Lifecycle, CIEM, and identity threat protection capabilities.

This role acts as the single technical point of contact for all identity related decisions, integrations, designs, and technical escalations, ensuring adherence to Zero Trust principles, Client Delivery & Cyber frameworks, and the architectural governance process.

________________________________________

• Serveas the lead architect for all identity capabilities: IGA, directories (AD/OTAD/Entra ), RBAC/ABAC, Conditional Access, PKI, CIEM, machine identity,identity lifecycle automation.
• Ownthe architectural strategy and roadmap for the Identity Pillar across Year 1(I&D) and influence Year 2 planning.
• Actas the single technical authority across all identity work streams, ensuring coherence, interoperability, and alignment with Zero Trust Identity outcomes.
• Lead technical governance engagement:
  Information Security TAG, PESA approvals,Design Authority reviews, and cross pillar integration sessions.

• Lead comprehensive DAAS discovery for identity components:
  • oidentitystores and directories
  • oADforests/domains and OT AD footprint
  • oapplicationidentity models
  • oentitlements,access patterns, privileged roles
  • oIGAprocess and connector readiness
  • ononhuman / service identities
• Conduct identity specific discovery across:
  • oJMLprocesses, access request flows, attestation cycles
  • odirectorysecurity posture (CIS benchmarks, Microsoft best practices)
  • oaccountdiscovery (human, service, machine) across IT, OT, cloud, SaaS, air gappedsystems
• Evaluate and document:
  • oidentityrisks
  • oidentitylifecycle issues
  • ounmanagedaccounts
  • oaccesspolicy gaps
  • odiscoverylogs
  • otechnicalconstraints
  • odiscoveryoutputs traceable to future designs

• ProduceHL/ML/LLD for the IGA platform (SailPoint/Saviynt/etc.).
  • olifecycleautomation (Joiner/Mover/Leaver)
  • oentitlementsmanagement
  • orolemining & identity analytics
• Define integration patterns with:
  • oService Now
  • oSIEMfor identity related detections
  • oPAM/PIMfor privileged identities
• Produce architecture for AD, Entra , and OT AD identity capabilities:
  • osecureconfiguration baselines
  • onamingconventions, OU design, GPO strategy
  • oidentitylifecycle & sync patterns
  • odirectory-tieringstrategy (Tier
    0)
• Define enterprise RBAC/ABAC models:
  • obusinessroles
  • oapplicationroles
  • osegregationof duties
  • ogovernanceand lifecycle of roles

• Architect conditional access policies (CA rules, sign in risk, device trust, session controls).
• DefineMFA strategy:
  Authenticator App, FIDO2, passwordless, biometrics.
• Define Zero Trust authentication patterns for:
  • othirdparties
  • oOTidentities where applicable

• Produce architecture for PKI, certificate issuance, renewal, and lifecycle governance.
• Define trust anchors and certificate policies for:
  • ouseridentities
  • oOTand cloud workloads
• Define cloud identity entitlement patterns (Azure/AWS).
• Establish least privilege, JIT/JEA patterns for cloud workloads.

• Provide hands on architectural oversight to ensure implementations follow approved designs.
• Overseerollout and validation of:
  • oIGAconnectors, workflows, lifecycle processes
  • oAD/EntraID configuration updates and hardening
  • oConditionalaccess/MFA/polic…