Infrastructure Security and IAM Architect
Confirmed on the employer's own hiring board on Nov 5, 2026. First seen by Alion on Nov 5, 2026. Elfonze Technologies scores B on the Alion truth index.
This is a remote position.
Role Summary
Designs the identity, access and infrastructure security architecture for a carve-out, covering the hybrid domain controller and Entra ID estate. Owns the target-state design and the technical approach for moving users, mailboxes and collaboration content. Re-architects only where the separation requires it.
Job Responsibilities
Design the target identity architecture across on-premises Active Directory and Microsoft Entra ID
Define SSO, MFA, Conditional Access and privileged access models
Design directory synchronisation using Microsoft Entra Connect and tenant coexistence
Architect application sign-in and federation using SAML, OAuth 2.0 and OpenID Connect
Design network access authentication using RADIUS and 802.1X
Define infrastructure security controls: segmentation, firewalls, key and secrets management
Design landing zone security controls and guardrails across Azure and AWS
Select and configure migration tooling for user, mailbox, SharePoint and Teams moves
Produce high-level and low-level designs and review them with client architects
Define security logging requirements for identity and infrastructure events
Required Experience
10+ years of relevant experience in infrastructure and security architecture
5+ years designing and implementing identity, including on-premises domain controller clusters
Strong understanding of Active Directory, Kerberos, LDAP and DNS
Strong understanding of Microsoft Entra ID and Entra Connect version 2 or above, including Entra Domain Services
Hands-on experience with SSO, MFA and Conditional Access
Experience with at least one third-party identity provider such as Okta or Ping Identity
3+ years of experience with SAML and OAuth 2.0, plus OpenID Connect
Understanding of RADIUS-based authentication and 802.1X
Experience with migration tools such as BitTitan, Quest and AvePoint
Experience with mailbox, SharePoint, Teams and user migration
Experience with at least two cloud providers (Azure and AWS)
Experience designing and implementing landing zones with security controls and guardrails
Experience with Azure Key Vault or equivalent key management services
Experience designing colocation architectures
Deep understanding of hyper-converged infrastructure
Exposure to at least two OEMs or two cloud providers in each technology area
Strong communication skills, with prior experience working with UK and EU clients
Willingness to travel as required and to work in the client time zone
Prior infrastructure background alongside the specialism above
Prior experience in IT consolidations, mergers, demergers and carve-outs (mandatory)
Relevant professional certifications strongly recommended