IAM Security Architect
11 days ago
Sheffield
Dev/Null Security is seeking a Security Architect with a strong engineering background to lead Identity and Access Management design across large, complex enterprise environments. You will have built, integrated and operated identity services, and now own solution designs or be ready to take that step. You will turn business requirements into practical architectures, validate technical choices and support engineers through implementation and operational handover. The role covers workforce, privileged and non-human identities, including service accounts, cloud workloads and emerging AI agent identities. You will produce high-level designs, reusable patterns and architecture decisions, and present and defend your recommendations at design authorities and with senior stakeholders. • Significant hands‑on experience in IAM, security or platform engineering, with evidence of designing and delivering enterprise identity solutions. Senior engineers moving into architecture are welcome., • Experience implementing and troubleshooting authentication, federation, provisioning and access controls, with a working understanding of identity governance and administration (IGA) and privileged access management (PAM)., • Strong understanding of OAuth 2.0, OpenID Connect, SAML and SCIM, including protocol selection, token validation, claims and trust relationships., • Understanding of joiner, mover and leaver processes, access reviews, segregation of duties, role‑based and attribute‑based access control, and least privilege., • Practical experience with cloud identity services, enterprise directories and application or API integration; understanding of containers, Kubernetes and microservices., • Understanding of SPIFFE and SPIRE: workload identities, trust domains, SVIDs, node and workload attestation, credential rotation and federation. Ability to explain how workload authentication connects to separate authorisation controls., • Awareness of IAM challenges in AI and agentic AI: agent ownership, autonomous versus user‑delegated access, permission boundaries, credential lifecycle and auditability., • Ability to automate integrations and provisioning through APIs, scripting and infrastructure as code, and diagnose identity failures across application and infrastructure boundaries., • Experience of operational delivery and technology transformation, with the ability to balance security, resilience, user experience, cost and legacy constraints., • Clear communication with engineers, business stakeholders and executives; ability to translate requirements into designs, explain trade‑offs and work within security governance frameworks., • Relevant degree or equivalent practical experience. CISSP, CISM, SABSA, TOGAF or relevant identity and cloud certifications are desirable., • Practical delivery and sound technical judgement carry more weight than certifications. Production SPIRE experience or AI identity proof‑of‑concept work is desirable. IAM architecture and engineering: • Design secure, scalable and resilient identity services spanning cloud, SaaS and on‑premises environments, with clear integration patterns and operational ownership., • Define authentication, single sign‑on, federation, MFA and password less patterns appropriate to user needs, application capabilities and risk., • Design identity lifecycle automation, access requests and approvals, entitlement models, access reviews and timely removal of access., • Define privileged access controls, including just‑in‑time access, credential management, session accountability and tested emergency access., • Work with engineers to prototype integrations, troubleshoot complex failures and validate designs through proofs of concept and implementation reviews., • Plan migrations from legacy directories, federation services and long‑lived credentials, including dependencies, staged rollout, rollback and service continuity., • Define ownership, inventory and lifecycle controls for service accounts, service principals and workload identities, reducing unnecessary standing access and shared secrets., • Assess where SPIFFE and SPIRE fit within the wider IAM architecture; define trust domains, workload registration, attestation and federation boundaries., • Design patterns using short‑lived workload credentials, including X.509‑SVIDs or JWT‑SVIDs where appropriate, and mutual TLS for service authentication., • Work with platform teams on credential delivery and rotation, availability, trust bundle management and integration with Kubernetes, service meshes and cloud services., • Define how authenticated workload identities map to authorisation policies, including containment of compromised workloads and the limits of credential expiry and revocation., • Work with AI and application teams to assess identity requirements for agents accessing tools, APIs and enterprise data, applying established IAM controls to emerging use cases., • Distinguish an agent’s identity, its hosting workload and any user it acts for; define clear ownership, delegated authority and limits on autonomous access., • Design least‑privilege access with scoped, time‑bound credentials, controlled delegation and explicit approval for sensitive actions where required., • Consider how prompt injection, excessive permissions, token theft or confused‑deputy behaviour could lead to unauthorised actions; enforce access controls outside model instructions., • Define agent registration, access review, suspension and retirement, with audit trails linking agent actions to the relevant identity, user context and authorisation decision., • Define identity audit events and monitoring requirements covering authentication, privilege changes, provisioning failures and suspicious access, without exposing credentials or tokens., • Agree service health measures, recovery requirements, support runbooks and incident response procedures with operations and security teams., • Own solution designs aligned to functional and non‑functional requirements, business strategy, security principles and enterprise standards., • Produce reference architectures, high‑level designs, integration patterns and architecture decision records that engineering teams can implement., • Define target states and phased transformation roadmaps, with clear dependencies, migration steps and acceptance criteria., • Provide implementation assurance, review detailed designs and resolve gaps between architecture intent and operational constraints., • Assess technology options on capability, interoperability, supportability and commercial fit; explain recommendations and trade‑offs without relying on a single vendor., • Maintain clear documentation and provide technical consultation to transformation programmes and teams outside the identity domain., • Present and defend designs at technical design authorities, adapting the level of detail for executives, engineering teams and specialist reviewers., • Ensure architectures, decision records, deviations and technical risks undergo appropriate peer review and governance approval., • Map design choices to security policies, control objectives and applicable compliance requirements; record exceptions and compensating controls., • Identify, manage and elevate technical and delivery risks, including identity outages, excessive access, legacy dependencies and migration failure., • Explain the security and operational consequences of design decisions, with practical remediation options and accountable owners., • Coordinate dependencies across identity, platform, application, AI, networking and security operations teams., • Provide technical leadership through design and delivery, mentor engineers and help teams develop their architecture capability., • Challenge assumptions constructively and communicate complex identity concepts clearly to technical and non‑technical stakeholders., • Build effective relationships with clients, delivery partners and internal teams; make decisions that account for risk, delivery effort, cost and long‑term support. Whilst DevNull Security is a remote‑first company, our consulting team may be required to travel to client sites up to 3 times per week, depending on project and customer needs. We believe that a career in cybersecurity should be accessible to everyone. We actively welcome applicants from all walks of life, regardless of race, ethnicity, gender identity, age, sexual orientation, disability, neurodiversity, socioeconomic background, or any other aspect of identity. As a growing company, we’re committed to fostering an inclusive, equitable, and accessible hiring experience. We proactively offer adjustments during application and assessment - tell us what you need. #J-18808-Ljbffr
Chef & Cook
Waiters
Bar Staff
Retail
Kitchen Porter
Barista
Quick Service
Accounting & Finance
Animal Care
Art, Media, Design
Child Care
Cleaning
Construction & Trades
Customer Service
Education
Engineering
Entertainment
Events & Promotion
Health & Social Care
Host & Hostess
Information Technology
Legal
Management
Manufacturing
Office & Admin
Online Jobs
Sales & Marketing
Salon & Beauty
Science
Security
Sports & Wellness
Warehouse
Writing & Editing