{"id":4022616,"url":"https://alion.io/job/kaust-identity-and-access-management-technical-expert","title":"Identity and Access Management Technical Expert","company":{"id":36398,"name":"KAUST","domain":"kaust.edu.sa","url":"https://alion.io/company/kaust-discovery","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SuccessFactors","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Saudi Arabia"],"countries":["SA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"BeyondTrust","optional":false},{"name":"CyberArk","optional":false},{"name":"Delinea","optional":false},{"name":"IAM","optional":false},{"name":"ITSM","optional":false},{"name":"LDAP","optional":false},{"name":"Least Privilege","optional":false},{"name":"PKI","optional":false},{"name":"SIEM","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Zero Trust","optional":false}],"status":"live","first_seen_at":"2026-11-10T15:42:13Z","employer_posted_date":"2026-11-10","last_verified_at":"2026-11-10T21:56:48Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Position Summary\n\nThe IAM Technical Expert is a senior hands-on expert technical authority accountable for the architecture, detailed solution design, integrated technical implementation and orchestration of KAUST’s enterprise Identity and Access Management (IAM), Privileged Access Management (PAM), and Identity Governance and Administration (IGA) capabilities. The role leads secure identity integration across Microsoft Entra, Saviynt, a selected PAM technology, and enterprise, cloud, academic and research systems. It drives phased deployment, engineering quality, automation and operational readiness, establishing sustainable services with formally designated owners.\n\nMajor Responsibilities\n\nEnterprise Identity Architecture & Technical Direction\nOwn the end-to-end IAM, PAM and IGA target architecture, reference designs, implementation principles and phased technical roadmap aligned with KAUST security strategy and Zero Trust principles.\nDefine trust boundaries, identity data flows, authoritative sources, integration patterns, identity stores and control ownership across on-premises, hybrid and multi-cloud environments.\nAct as design authority for cross-platform technical decisions, technical debt, interoperability, resilience and engineering standards; maintain current architecture diagrams and decision records.\nDesign for complex identity populations including staff, faculty, students, researchers, visiting scholars, affiliates, contractors, service identities and external collaborators.\n\nIAM: Authentication, Federation & Access Architecture\nLead Microsoft Entra architecture and hands-on engineering for workforce identities, hybrid identity synchronization, single sign-on, federation, MFA, Conditional Access and identity protection.\nDefine secure authentication and authorization patterns using SAML 2.0, OAuth 2.0, OpenID Connect, FIDO2/passkeys, SCIM, LDAP and API-based integrations as appropriate.\nEngineer application onboarding patterns, group and attribute-based access, delegated administration, break-glass access and recovery controls.\nIntegrate identity services with enterprise applications, cloud platforms, collaboration tools, research platforms, laboratory systems and external federation ecosystems.\n\nPAM: Privileged Access Architecture & Engineering\nLead PAM platform evaluation, detailed design, implementation and integration, including privileged discovery, account and secret onboarding, secure credential vaulting and automated rotation.\nEngineer privileged session brokering, recording and monitoring; just-in-time/just-enough administration; approval workflows and privileged elevation for infrastructure and cloud.\nAddress administrators, root/service accounts, local and domain privileged accounts, application credentials, machine identities, secrets, API keys and emergency access.\nDesign PAM integrations with Entra, Saviynt, directories, infrastructure, cloud control planes, SIEM/SOC, ITSM and relevant DevOps/secrets tooling.\nDefine PAM coverage, exception handling, platform hardening, resilience, controlled cutover and evidence that standing privilege and unmanaged secrets are reduced.\n\nIGA: Identity Lifecycle, Governance & Access Controls\nLead Saviynt IGA solution architecture, configuration, integration and rollout for identity aggregation, birthright access and joiner-mover-leaver automation.\nDesign access requests, policy-based approval, entitlement catalogues, role models, access reviews/certifications, segregation-of-duties controls and exception processes.\nIntegrate authoritative HR/student/affiliate data and application endpoints; define identity correlation, reconciliation, provisioning, deprovisioning and orphan-account remediation.\nEnsure consistent governance of privileged entitlements with PAM, including account ownership, approval, attestation, revocation and audit evidence.\nPartner with business and application owners to establish entitlement ownership, reviewer accountability and risk-based certification scope.\n\nIntegrated Platform Implementation & Orchestration\nTranslate target architecture into low-level designs, interface contracts, configuration baselines, delivery backlogs, test plans and repeatable deployment patterns.\nPersonally guide complex designs, prototypes, connector development and troubleshooting while directing work by internal engineers, application teams and implementation partners.\nOrchestrate interdependencies among Entra, Saviynt, PAM, HR, ITSM, directories, applications, cloud, SOC and data owners; sequence technical releases to avoid control gaps.\nDrive end-to-end integration testing, security validation, migration and reconciliation testing, performance testing, defect remediation and formal cutover criteria.\nApply automation, infrastructure-as-code and secure API practices where relevant; manage technical configuration and implementation evidence.\n\nIdentity Security, Resilience & Risk Reduction\nEmbed least privilege, phishing-resistant authentication, policy enforcement, privileged access isolation and continuous access evaluation where supported.\nDesign auditability, logging, alerting, threat-detection integrations and secure handling of identity secrets, tokens, keys and sensitive identity data.\nPlan high availability, backup/recovery, emergency access, vendor dependencies and disaster-recovery testing for critical identity services.\nPartner with Security Operations, GRC and IT to remediate identity risks, toxic entitlements, excessive permissions, dormant accounts and failed lifecycle controls.\n\nTechnical Governance, Quality & Assurance\nLead technical design reviews, standards compliance, architecture exceptions, threat modeling and solution assurance across all IAM, PAM and IGA workstreams.\nMaintain solution blueprints, data mappings, interface specifications, configuration standards, build guides, design decisions and technical risk/dependency logs.\nProvide evidence-based recommendations on platform fit, licensing and design trade-offs; escalate material risks and unresolved decisions through approved governance.\nSet measurable acceptance criteria for connectivity, control efficacy, provisioning accuracy, performance, resilience, recoverability and supportability.\n\nOperating Model Design & Phased Service Transition\nDesign the IAM/PAM/IGA target operating model with service definitions, RACI, control ownership, support tiers, runbooks, escalation, change and incident processes.\nBuild operational readiness into each release: design, build, test, deploy, stabilize, formally transition to named service owners and optimize.\nEstablish monitoring, service KPIs, access-control quality measures, operational acceptance criteria, training and knowledge transfer.\nLead technical hypercare and defect resolution while securing formal business-as-usual (BAU) acceptance; avoid indefinite dependence on the technical lead or vendors.\n\nCross-Functional Stakeholder Leadership\nDrive working-level technical alignment across Information Security, IT, HR, Academic Affairs, Research Computing, application owners and external partners.\nResolve source-of-truth conflicts, application readiness, ownership ambiguities, integration constraints and access-policy implementation trade-offs.\nPresent clear architecture options, risks, sequencing and technical progress to the CISO, CIO and relevant governance groups.\nChampion reliable identity user journeys while accommodating high-assurance access to sensitive research, critical infrastructure and institutional systems.\n\nVendors, Delivery Partners & Engineering Capability\nLead technical requirements, solution evaluation, proofs of concept, partner design reviews and implementation acceptance for IAM, PAM and IGA technologies.\nHold system integrators and vendors accountable for design integrity, engineering quality, interoperability, documentation and knowledge transfer.\nMentor KAUST engineers and establish reusable design patterns, integration templates, configuration standards and troubleshooting guidance.\n\nKey Deliverables & Measurable Outcomes\nApproved integrated IAM-PAM-IGA target architecture, platform integration blueprint, security design principles and phased technology roadmap.\nBuild-ready low-level designs, identity data model, integration specifications, technical standards, migration plans and documented architectural decisions.\nImplemented and tested Entra, Saviynt and PAM technical capabilities with signed-off controls, production integrations and formal release acceptance.\nMeasurable progress in application onboarding, identity lifecycle automation, certification coverage, privileged-account coverage, credential rotation and reduction of standing privilege.\nEstablished target operating model, service catalogue, operational KPIs, runbooks, training, hypercare records and formally accepted BAU ownership.\n\nAccountability, Decision Rights & Program Interfaces\nThe Principal IAM Architect owns technical architecture, design integrity, engineering direction, integrated implementation assurance and technical readiness for each transition.\nThe IAM Program Manager owns integrated program planning, governance cadence, resources, cross-program dependencies and consolidated reporting; both roles coordinate delivery sequencing.\nThe CISO and relevant IT leaders approve major architecture exceptions, permanent organizational responsibilities and service ownership through applicable governance.\nNamed BAU teams assume ongoing service delivery after acceptance; the architect supports stabilization but is not the default permanent operations manager.\n\nCompetencies\n\nAutonomy\nServes as principal technical design authority within approved architecture, risk appetite and delegated decision rights.\nLeads engineering priorities and implementation choices while escalating material strategic, commercial or ownership decisions.\n\nInfluence\nBuilds alignment among the IS, IT, HR, Research, academic stakeholders, application owners and delivery partners.\nExplains architecture, options, integration dependencies and risk in terms understandable to both engineers and senior leaders.\n\nComplexity\nIntegrates heterogeneous identity populations and technologies across legacy, SaaS, hybrid, cloud, scientific and highly privileged environments.\nBalances security outcomes, user experience, technical interoperability, engineering constraints and iterative rollout risk.\n\nBusiness Skills\nDemonstrates structured technical delivery leadership, vendor challenge, rigorous documentation, prioritization and stakeholder decision-making.\nDevelops internal engineering capability, operational sustainability and measurable IAM/PAM/IGA control outcomes.\n\nQualifications\n\nEssential\nBachelor’s degree in Computer Science, Information Technology, Cybersecurity, Engineering or related discipline.\nAt least 10 years of relevant enterprise IT/security experience, including substantial hands-on IAM architecture and implementation leadership; proven ability to own complex multi-platform technical delivery.\nDemonstrated production delivery experience with Microsoft Entra and Saviynt IGA, including integration, provisioning, identity lifecycle and access governance.\nStrong experience designing and implementing enterprise PAM controls using a leading platform (such as CyberArk, Delinea, BeyondTrust or equivalent); product selection is not assumed.\nDeep knowledge of identity and federation standards: SAML, OAuth 2.0, OpenID Connect, SCIM, LDAP, APIs, certificates, FIDO2, PKI and secure secrets handling.\nAbility to lead low-level solution design, cloud/on-premises identity integrations, identity data mapping, automation, migration, test assurance and technical troubleshooting.\nExperience delivering privileged session controls, credential rotation, JIT elevation, account discovery and service/machine identity governance.\nProven experience coordinating multiple engineering teams, vendors, app owners and IT/security operations through controlled production relea...","description_format":"text","description_chars":12291,"description_truncated":true,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Identity Management","Higher Education"],"lifecycle":[{"event":"open","at":"2026-11-10T15:42:13Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":29,"reasons":["conf:1","win:early"],"computed_at":"2026-11-10T23:02:12Z"},"pay":null,"html_url":"https://alion.io/job/kaust-identity-and-access-management-technical-expert","json_url":"https://alion.io/job/kaust-identity-and-access-management-technical-expert.json","meta":{"generated_at":"2026-11-10T23:02:12Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1024,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-11T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":36398},"rest":"https://alion.io/mcp/rest/get_company?id=36398"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fkaust-identity-and-access-management-technical-expert"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fkaust-identity-and-access-management-technical-expert"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fkaust-identity-and-access-management-technical-expert"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/kaust-identity-and-access-management-technical-expert\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fkaust-identity-and-access-management-technical-expert"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4022616}},{"tool":"search_jobs","arguments":{"company":"kaust.edu.sa","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4022616},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}