IAM Architect

Job Title: IAM Architect

Location: Atlanta, GA

Work Arrangement: Hybrid

Employment Type: Contract

About the Role

We are seeking an experienced IAM Architect to join our team. The successful candidate will be responsible for driving deep identity architecture, hands-on configuration, tool platform migration, and directory consolidation across access management, Privileged Access Management (PAM), and Identity Governance and Administration (IGA) systems. This is a highly execution-oriented role requiring live implementation, policy design, and target-state architecture rather than conceptual or advisory strategy alone.

Key Responsibilities

• Design, develop, implement, and maintain target-state identity architectures in a multi-entity/post-merger environment, executing configuration workflows, policy designs, custom connector developments, role modeling, and user certification campaigns.
• Collaborate with cross-functional teams to design and execute live platform transitions (e.g., SailPoint to ServiceNow), migrating data/configurations, reshaping governance frameworks, and managing target-state synchronization without disrupting operations.
• Troubleshoot issues and provide effective solutions for hybrid sync (Entra Connect) failures, session management bottlenecks, credential vaulting issues, and complex provisioning/deprovisioning logic errors.
• Participate in design reviews, testing, documentation, and deployment activities

for core PAM suites (CyberArk, BeyondTrust, Delinea) and IGA suites (SailPoint, Saviynt, ServiceNow), deploying privileged elevation workflows and automated credential rotations.

• Follow established company policies, procedures, security standards, and development practices while driving Active Directory consolidations, navigating forest/trust configurations, building GPO/schema rollouts, and using object migration tooling (e.g., ADMT, Quest).
• Perform other job-related duties as assigned, including managing the lifecycle of non-human identities (NHI), establishing service account naming standards, and staying updated on emerging workload identity authorization patterns (OIDC, SPIFFE, just-in-time credentialing).

Required Qualifications

· Deep identity architecture across systems — access management, PAM, and IGA/governance. Hands-on configuration and implementation experience is required, not strategy or advisory alone: connector development, policy and workflow design, role modelling, and certification campaign build-out, not only architecture diagrams and roadmaps.

· Direct, hands-on tool experience across leading IGA and PAM platforms. Implementation and administration experience, not evaluation-level familiarity.

PAM: hands-on work with one or more of CyberArk, Beyond Trust, or Delinea, including session management, credential vaulting, and privileged elevation workflows.

IGA: hands-on work with one or more of SailPoint, Saviynt, or ServiceNow Identity Governance, including connector development, provisioning/deprovisioning logic, and role mining. Experience migrating between major IGA platforms (e.g., SailPoint to ServiceNow, or similar transitions) is a strong plus — ideally someone who has personally led or executed a live platform transition, including target-state design, data/configuration migration, and governance framework rebuild, not simply evaluated the platforms.

· Strong Active Directory fluency with hands-on consolidation experience. Comfortable working closely with AD without owning it: forest/trust configuration, GPO and schema work, hybrid sync (Entra Connect) troubleshooting, and object migration tooling (e.g., ADMT/Quest-class) through an actual tenant or directory consolidation project, not just conceptual familiarity with AD structure.

· Proven, hands-on transformation experience. Design and implementation of target-state identity architecture in a post-merger or multi-entity environment: directory and tenant integration, platform consolidation (merging multiple IGA/PAM tools into one), and the execution work that follows the roadmap, not only the roadmap itself.

· Working familiarity with the newer tooling landscape, including non-human identity and AI agent governance. Hands-on exposure to service account/NHI lifecycle management (naming standards, reconciliation, automated credential rotation) is a plus; awareness of emerging workload identity and AI-agent authorization patterns (OIDC/SPIFFE-style federation, just-in-time credentialing) is highly valued.

Work Authorization

Applicants must be legally authorized to work in the United States.

Equal Employment Opportunity

Themesoft Inc is an Equal Employment Opportunity employer. We consider qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other status protected by applicable federal, state, or local law.