Identity Architect (Domain Lead)_ W2

Title: Identity Architect (Domain Lead)
Location: Remote

Leads 2-3 engineers.
Designs and delivers the move of each acquired company's directories, tenants and access model onto the parent's Entra ID / M365 standard, while keeping users in both environments signing in and working until final cutover.
•  Discover and map the acquired identity estate: AD forests and domains, tenants, federation, privileged accounts
•  Design the target identity model, cross-tenant coexistence and the order of UPN and domain moves
•  Plan the impact on SSO applications, devices and non-human identities (service accounts, service principals), and set the migration sequence
•  Re-point SSO applications (SAML, OIDC, SCIM) and migrate non-human identities with least privilege
•  Implement SOX access controls with the compliance team and retire the source environment at closeout
•  Hands-on: configuration, scripting and cutover execution
Must have: [8+] years of identity and access management, with design ownership on cross-tenant migrations; deep Entra ID (Conditional Access, SSO, MFA, Entra Connect) and
Active Directory; SAML/OIDC/OAuth/SCIM and claims mapping; PowerShell, Python and Graph; DNS and PKI.
Nice to have: SC-300, Quest or similar migration tooling, AWS/Google Cloud Platform/OCI identity.