About the Role
As an IAM and PAM Architect at EISAI GDBT GCC, you will lead the architecture, design, and governance of
enterprise identity platforms. You will define the strategic direction for Privileged Access Management,
Microsoft Entra ID and Active Directory. The role focuses on scalability, security, Zero Trust alignment, and
cloud-first identity architecture.
Key Responsibilities
Privileged Access & CyberArk
• Architect and govern Privileged Access Management (PAM) using CyberArk (PAS, PSM, PTA, EPM).
• Define Just-in-Time (JIT) privileged access models aligned with least-privilege principles.
• Design privileged credential vaulting, rotation, and session monitoring strategies.
• Integrate CyberArk with Active Directory and Entra ID for end-to-end privileged identity lifecycle
management.
Entra ID & Cloud Identity
• Architect enterprise-scale Microsoft Entra ID environments with high availability and resilience.
• Define Conditional Access, MFA, Identity Protection, and Zero Trust policies.
• Design RBAC models, administrative units, and scoped role assignments.
• Lead application onboarding architecture using OIDC, OAuth 2.0, SAML, WS-Federation, and SCIM.
Identity & Directory Architecture
• Define and own the enterprise identity architecture for Active Directory, Entra ID, and hybrid identity.
• Design multi-forest, multi-tenant, and hybrid identity models aligned with business and security
requirements.
• Lead domain and forest consolidation, migration, and modernization initiatives.
• Establish directory service standards, reference architectures, and design patterns.
Identity Governance & Security
• Define Identity Governance frameworks, including access reviews, entitlement management, and
lifecycle workflows.
• Architect external identity (B2B/B2C) collaboration and secure guest access models.
• Establish security guardrails, audit logging, monitoring, and compliance controls.
• Align identity architecture with regulatory, audit, and compliance standards.
Hybrid Identity & Integration
• Architect directory synchronization strategies using Entra Connect / Azure AD Connect.
• Define coexistence and cut-over strategies for legacy IAM and federated services.
• Design PKI, certificate, and Kerberos authentication architectures.
Architecture Governance & Leadership
• Produce solution designs, reference architectures, and architecture decision records (ADRs).
• Conduct architecture reviews, risk assessments, and design validations.
• Provide technical leadership and mentorship to identity engineering teams.
• Collaborate with Security, Cloud, Infrastructure, and Application teams to ensure alignment.
• Guide automation strategy using PowerShell, Microsoft Graph API, and DevOps pipelines.
Required Skills
Expert-level hands-on experience with CyberArk PAM (PAS, PSM, EPM, PTA, Secrets
Management).
• Strong experience in enterprise PAM architecture design.
• Deep understanding of: Privileged identity lifecycle/Least-privilege and Zero Trust principles
• Strong knowledge of Active Directory and hybrid identity environments.
• Experience integrating CyberArk with Microsoft Entra ID.
• Deep expertise in Microsoft Entra ID, Conditional Access, and Zero Trust architecture.
• Expertise in privileged identity governance and access models.
• Strong understanding of PKI, certificates, and Kerberos authentication.
• Proficiency in PowerShell and API-driven automation.
• Experience designing secure, scalable enterprise identity platforms.
Preferred Skills
• Expert-level knowledge of Active Directory, DNS, Group Policy, and hybrid identity design.
• Working experience in Microsoft 365 Suite services like SharePoint, Teams, Exchange Online
etc.
• Experience with Microsoft Identity Manager (MIM) or similar lifecycle tools.
• Exposure to SIEM integration and security monitoring for identity systems.
• Experience with Delinea, ADFS, or other enterprise IAM/PAM platforms.
• Knowledge of multi-forest and complex hybrid identity environments.
Education & Certifications
• Bachelor’s degree in computer science, IT, or related field.
• CyberArk Certification is preferred.
• Microsoft Certified: Identity and Access Administrator Associate preferred.
• Microsoft 365 Certified: Enterprise Administrator Expert preferred.