Senior IAM Architect
JOB DUTIES:
- Own the enterprise IAM architecture strategy, target state, and roadmap across cloud, on-premises, and hybrid environments, aligned to Zero Trust and security standards.
- Serve as the IAM technical authority and provide hands-on architectural leadership across infrastructure, cloud, and platform security initiatives.
- Design and document end-to-end IAM capabilities across IGA, access management, PAM, secrets, and non-human identities.
- Define integration patterns and reference architectures; evaluate build vs. buy and emerging IAM capabilities (e.g., passwordless, AI/agentic identities, decentralised identity) to deliver scalable services across applications, infrastructure, and DevOps tooling.
- Architect authentication and authorisation (SSO, MFA, RBAC/ABAC) and standardize protocols (OAuth2/OIDC, SAML, SCIM, LDAP).
- Lead IAM platform design and integration across cloud/hybrid (e.g., Microsoft Entra ID, Active Directory, SailPoint, PingFederate/Ping Identity, AWS IAM, CyberArk or equivalent).
- Define identity lifecycle controls (joiner/mover/leaver, provisioning, access certifications, and role/entitlement modeling).
- Identify IAM risks and architecture gaps; define constraints and mitigations, and drive remediation through roadmap and delivery items.
- Ensure IAM controls and integrations meet security and regulatory requirements (e.g., NIST SP 800-63, ISO 27001, SOC 2, GDPR) and support audit activities.
- Partner with business stakeholders to align IAM outcomes to enterprise objectives and communicate decisions and tradeoffs to senior leadership.
- Strong experience in the identity and access management, preferably at architecture level, however IAM Engineers seeking opportunities to advance to an architecture role will be considered
- Strong experience across core IAM domains: IGA (lifecycle, certifications), access management (SSO/MFA), Conditional Access, PAM, and non-human identity (workload/service identities), with hands-on-experience with one or more enterprise IAM platforms (e.g., Microsoft Entra ID/Azure AD, Okta, Ping, SailPoint) and integration across cloud/hybrid environments.
- Deep knowledge of authentication/authorisation patterns and protocols: OAuth 2.0/OIDC, SAML 2.0, SCIM, and LDAP/AD.
- Solid understanding of cloud IAM (AWS, Azure, and/or GCP), including identity federation and least-privilege design.
- Experience assessing IAM risks and security controls, defining mitigations, and supporting audits and compliance requirements (e.g., NIST/ISO).
- Strong analytical, problem-solving, and communication skills, with the ability to engage both technical and non-technical stakeholders effectively
- Collaborative team player who adapts quickly to changing priorities while maintaining attention to detail
- Proven ability to define IAM target state, reference architectures, standards, and multi-phase roadmaps aligned to Zero Trust.
- Experience with secrets management (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault).
- Knowledge of DevSecOps practices and integrating IAM controls into CI/CD pipelines.
- Exposure to machine/workload identity federation (e.g., SPIFFE/SPIRE) and modern approaches to non-human identity.
- Funding provided to support your self-development
- 5 weeks of paid vacation
- Fully remote work model
- Flexible working hours
- On-site canteen & home office meal vouchers
- Pension plan or DIP contributions
- Discounted phone plans & company product discounts
- Multisport Card & cafeteria program
#LI-REMOTE
Resideo is a global leader in smart home and building solutions, with trusted brands including Honeywell Home, First Alert, and Resideo helping people feel more comfortable, secure, connected, and in control every day. Our products and technologies are found in more than 150 million homes and businesses worldwide. From intelligent climate solutions to security, sensing, water, and connected home technologies, Resideo develops and manufactures products designed to simplify everyday life and help protect what matters most. Our global teams span engineering, manufacturing, software, product management, supply chain, customer experience, and more - all working together to shape the future of connected living through innovation, quality, and meaningful real-world impact. At Resideo, our teams help create products and experiences that make everyday life more comfortable, secure, and connected for millions around the world. Learn more at www.resideo.com.
You can find out more about how the talent community works here: Resideo Talent Community Terms. Our recruitment privacy notice Resideo -Recruitment Privacy Notice - Dec 16 2022 describes in more detail how we process your personal data and how you can exercise your personal data rights.
If a disability prevents you from applying for a job through our website, request assistance here.
Hiring Salary Range
Work Location
Incentive Eligible
Frequently Asked Questions
Apply
Submit your application through the Resideo careers site. Our Talent Acquisition team reviews applications based on alignment with the role.
Connect
If your background aligns, a recruiter may reach out to schedule an initial conversation to learn more about your experience and answer questions.
Interview
You may meet with hiring managers and team members through virtual or in-person interviews. The number and format of interviews can vary by role.
Decision and Offer
After interviews, the team reviews feedback and makes a decision. If selected, we will connect with you on next steps and offer details.
You can explore open roles and apply directly through the Resideo careers site. The Resideo Talent Acquisition team reviews applications submitted through the careers site and evaluates how a candidate’s experience aligns with role requirements.
Yes. Candidates are welcome to apply for multiple roles at Resideo.
The Resideo Talent Acquisition team will communicate with candidates throughout the hiring process. Timing may vary depending on the role and location.
Timelines vary based on the role, interview process, and location. Your Talent Acquisition Partner will keep you informed along the way.
You can join our Talent Network to stay connected on future opportunities, events, and updates.
All open roles are posted on the official Resideo careers site. Our Talent Acquisition team communicates using Resideo email addresses and will never request payment or financial information during the hiring process.
At Resideo, we aim to create an inclusive hiring experience where you’re evaluated based on your skills, experience, and potential. We welcome candidates from all backgrounds and are committed to a fair and respectful process.
If you need an accommodation at any stage of the application or interview process, our Talent Acquisition team is here to support you.
Didn’t find the right role?
