security architect for IAM systems

EPAM designs, implements, and optimizes secure Identity and Access Management architectures for global clients, combining identity engineering principles with AI-assisted tools to support data protection, compliance, and auditability.

• Design and implement IAM security architectures and controls across enterprise, cloud, and hybrid environments
• Gather business, technical, and compliance requirements for IAM implementations, migrations, and security improvements
• Define and improve IAM capabilities, including identity lifecycle management, provisioning and deprovisioning, SSO, federation, MFA, PAM, and access governance
• Design and improve authentication, authorization, and access control models, including RBAC, ABAC, least privilege, and Zero Trust
• Conduct IAM security architecture reviews, risk assessments, and access control design evaluations
• Develop IAM reference architectures, security standards, access control policies, and identity governance guidelines
• Evaluate IAM technologies and solutions, including IdPs, IGA, PAM, federation platforms, and cloud-native identity services
• Design and support IAM integrations with cloud platforms, SaaS applications, enterprise systems, directories, and APIs
• Collaborate with cloud, infrastructure, development, security operations, compliance, and enterprise architecture teams to integrate IAM security into enterprise solutions
• Support IAM automation using PowerShell, Python, REST APIs, SCIM, Terraform, or similar technologies
• Use AI-assisted tools and workflows for identity and access risk analysis, access reviews, entitlement analysis, role and access policy analysis, provisioning workflow optimization, compliance reporting, evidence collection, security scripting, documentation, and repetitive task automation
• Identify opportunities for AI-assisted IAM automation while ensuring validation, data protection, auditability, and human oversight
• Communicate IAM security risks, architectural decisions, and remediation plans to stakeholders and security leadership

• Bachelor's degree in Computer Science, Cybersecurity, Engineering, or equivalent practical experience
• 5+ Years of information security experience focused on IAM, identity security architecture, or IAM engineering
• Proven experience delivering or significantly contributing to IAM implementation, migration, integration, or modernization projects
• Hands-on expertise with at least one enterprise IAM, IGA, PAM, or identity federation platform
• Strong understanding of IAM principles, including identity lifecycle management, authentication, authorization, SSO, federation, MFA, RBAC/ABAC, least privilege, and privileged access
• Knowledge of IAM protocols and standards such as SAML, OAuth 2.0, OpenID Connect, SCIM, LDAP, or Kerberos
• Experience with IAM technologies such as Microsoft Entra ID, Active Directory, Okta, Ping Identity, SailPoint, Saviynt, CyberArk, or similar solutions
• Understanding of cloud IAM concepts and identity security controls across at least one major cloud platform: Azure, AWS, or GCP
• Understanding of security architecture principles and frameworks such as Zero Trust, NIST, ISO 27001, or similar
• Working knowledge of cloud security, network security, application security, data protection, and security operations; deep specialization in each is not required
• Intermediate practical experience with AI-assisted tools and automation, including access analysis, security research, IAM troubleshooting, structured prompting, generating and validating scripts, queries, access policies and documentation, simplifying repetitive workflows, and basic configuration of AI-assisted workflows or integrations
• Understanding of safe AI usage, including sensitive identity data protection, access control, auditability, and validation of AI-generated outputs
• Willingness to further develop AI automation skills
• Strong communication and collaboration skills
• Hands-on technical proficiency is a must
• Будет плюсом: Experience with IAM platforms such as Microsoft Entra ID, Okta, Ping Identity, ForgeRock, Auth0, SailPoint, Saviynt, CyberArk, or similar; experience with IGA, PAM, CIAM, or B2B/B2C identity scenarios; experience with cloud identity, workload identities, service principals, managed identities, and hybrid identity architectures; experience with IAM automation using PowerShell, Python, REST APIs, SCIM, Terraform, or similar technologies; experience integrating IAM solutions with SIEM/SOAR, security monitoring, and automated response workflows; experience with AI automation, AI agents, Microsoft Copilot Studio, Azure OpenAI, Amazon Bedrock, Claude, LangChain, Power Automate, or similar tools; understanding of AI security risks, including sensitive data exposure, prompt injection, excessive permissions, and insecure AI tool usage; relevant Security or IAM certifications; AI-related certifications

• Условий в вакансии нет