Need : Oracle Identity Management (IDM / IAM) SME & Architect

Location: Remote

Duration: 6+ Months

Note: 10+ years of deep technical hands-on experience required

Key Responsibilities & Scope of Work

1. Current-State Review & Assessment

• Workshops & Discovery: Lead discovery sessions with enterprise stakeholders to audit existing Oracle application architectures, hosting models, infrastructure dependencies, and identity environments.
• Identity Topology Mapping: Map existing identity providers (IdPs), authoritative HR/identity sources, federation/trust relationships, and current authentication standards.
• Account Inventory: Categorize all user populations (employees, contractors, vendors, partners) alongside non-human identities (service accounts, DBAs, shared accounts, and database credentials).
• Controls & Gap Analysis: Document existing capabilities and operational gaps across IAM, PAM, MFA, SIEM, certificate management, disaster recovery (DR), identity lifecycle workflows, and compliance controls.

2. Future-State IAM Architecture Design

• Target Application Integration: Architect target-state authentication, authorization, provisioning, and reconciliation for Oracle EBS, APEX, WebCenter, and iSupplier.
• IdP & Standards Modernization: Design seamless Enterprise SSO using Microsoft Entra ID / AD backed by modern standards (SAML 2.0, OAuth 2.0, OpenID Connect).
• Entitlement & Role Mapping: Establish robust group-to-role mappings translating Entra ID / AD groups into Oracle EBS responsibilities, APEX roles, WebCenter permissions, iSupplier privileges, and database access.
• Identity Lifecycle Automation: Build automated Joiner, Mover, and Leaver (JML) workflows, complete with failed-provisioning handlers and orphan-account detection.
• Risk & Architecture Alternatives: Evaluate architectural trade-offs, DR strategy, licensing impacts, supportability, and mitigation of vendor lock-in.

3. External & Supplier Identity Security

• Vendor Access Governance: Establish isolated, secure identity stores and lifecycle processes for external suppliers, partners, and contractors.
• Identity Verification & Proofing: Define delegated administration models, business sponsorship requirements, and identity proofing controls.
• Access Hygiene: Enforce mandatory MFA, account expiration policies, automated termination triggers, and periodic access certifications for external users.

4. Security, PAM, & Identity Governance (IGA)

• Zero Trust & Conditional Access: Implement MFA and risk-based Conditional Access policies, prioritizing phishing-resistant authentication (FIDO2/Passkeys) for high-risk and administrative access.
• Privileged Access Management (PAM): Design a dedicated PAM framework for administrators and DBAs featuring vaulting, just-in-time (JIT) access, privileged session monitoring, and secret key/certificate lifecycle management.
• Governance & Break-Glass: Implement Target-State Role-Based Access Control (RBAC), Segregation of Duties (SoD) enforcement, periodic access certifications, and emergency "break-glass" access procedures.
• AI & Threat Intelligence: Evaluate AI-enabled identity security and threat detection capabilities to identify anomalous access behaviors without compromising data protection.

5. Resiliency & Business Continuity

• Outage Architecture: Design fault-tolerant, resilient fallback authentication models to withstand outages in Entra ID, Oracle IAM/EISSP, networks, or underlying certificates.
• DR & Failover Operations: Establish clear RTO and RPO benchmarks, designing DR failover, rollback, and service restoration runbooks.
• Testing Standards: Define operational cadence and methodologies for testing break-glass and DR scenarios under live conditions.

6. Logging, Auditing, & SIEM Integration

• Comprehensive Audit Trail: Establish a full event logging inventory covering authentication, authorization, provisioning, and administrative events across all Oracle and IAM components.
• SIEM Alignment: Integrate log streams into enterprise SIEM platforms with pre-configured detection rules, alerting logic, time-synchronization (NTP), and log retention policies.
• Data Protection & Compliance: Ensure sensitive attributes, tokens, credentials, and personal data (PII) are masked across log systems to meet audit and regulatory compliance standards.

7. Implementation Roadmap & Cost Estimation

• Strategic Roadmap: Formulate a phased, multi-year deployment strategy including major milestones, pilot rollouts, and transition management.
• Risk & Readiness Management: Detail testing, validation, dependencies, assumptions, and change management strategies to ensure zero disruption to production business operations.
• ROM Cost Modeling: Prepare a Rough Order of Magnitude (ROM) financial estimate capturing one-time deployment expenses, recurring licensing, and operational support costs.

Required Qualifications & Competencies

• Experience: 10+ years of deep technical hands-on experience in Enterprise Identity & Access Management (IAM), with specialized expertise in Oracle Identity & Access Management (OAM/OIM/OIG/OIDC/OAC) and Oracle E-Business Suite (EBS) Security.
• Microsoft Cloud Stack: Demonstrated track record of integrating Microsoft Entra ID (Azure AD) and Active Directory with complex, legacy, and hybrid Oracle ecosystems.
• Oracle App Depth: Hands-on integration knowledge with Oracle EBS, APEX, WebCenter, and iSupplier modules, including underlying database security structures (Responsibilities, Menus, APEX Roles).
• Standards Mastery: Deep command of authentication, authorization, and federation protocols (SAML 2.0, OAuth 2.0, OIDC, SCIM, LDAP, Kerberos).
• PAM & Governance: Proficiency designing PAM architectures (CyberArk, BeyondTrust, HashiCorp Vault, or similar) and IGA frameworks (SailPoint, Saviynt, or Oracle IGA).

Certifications (Desirable): CISSP, CISM, Oracle Certified Professional (IAM/IDM), or Microsoft Certified: Identity and Access Administrator Associate