IAM Architect

About the Role

Mphasis is deploying a Senior IAM Architect specializing in Non-Human Identity (NHI) and Agentic Security as a Forward Deployed Engineer (FDE) embedded within a Tier-1 wealth management firm. Operating as the primary Mphasis technical presence in the client's cybersecurity organization, this individual will co-define the client's NHI strategy, build the execution roadmap, and provide hands-on architecture leadership across Privileged Access Management (PAM), machine identity, service account governance, and the rapidly evolving domain of AI agent and agentic workflow security.

This is not a back-office advisory role. The FDE model means you are in the client's environment daily — running architecture deep dives, facilitating whiteboarding sessions, navigating internal stakeholder alignment, and building the technical credibility and executive mindshare that position Mphasis as the client's trusted partner for NHI implementation and beyond. You will work closely with the Mphasis account team to ensure that the relationships and insights you develop translate into commercial growth on the implementation side.

Working closely with Head of IAM at Mphasis, you bring the full weight of the Mphasis IAM and Cyber Security practice behind you while operating with the autonomy and accountability of a senior client-embedded architect.

What You Will Do

NHI Strategy & Architecture Leadership

• Co-define the client's Non-Human Identity strategy — covering service accounts, API keys, secrets, certificates, tokens, and emerging AI agent identities — aligned to CISA NHI guidance, NIST frameworks, and the client's regulatory obligations (SEC, FINRA, SOX).
• Design the target-state NHI governance architecture: lifecycle management (creation, rotation, revocation), least-privilege enforcement, visibility, and audit readiness across on-premises, cloud, and hybrid environments.
• Develop and maintain the NHI execution roadmap in partnership with the client's CISO and cyber architecture team — translating strategy into prioritized, deliverable initiatives with clear milestones and measurable outcomes.
• Establish architecture standards and reference patterns for NHI across the client's technology estate, spanning cloud-native workloads (AWS, Azure, Google Cloud Platform), containerized environments (Kubernetes), and legacy systems.

PAM & Machine Identity Engineering

• Lead architecture and advisory on Privileged Access Management platforms — with hands-on depth in SailPoint Entro, CyberArk, Delinea, and next-generation NHI-native platforms including Clutch and Oasis.
• Design and govern machine identity programs: certificate lifecycle management, secrets management and API credential governance.
• Architect integrations between NHI platforms and the client's broader security ecosystem — SIEM, SOAR, CASB, and identity governance platforms — to ensure end-to-end visibility and automated remediation.
• Define and enforce Zero Trust identity principles for non-human entities in alignment with NIST SP 800-207, ensuring that every machine, service, and agent identity is authenticated, authorized, and continuously validated.

Agentic AI Identity & Emerging Threat Surface

• Serve as the client's subject matter expert on agentic identity challenges — the security implications of AI agents, autonomous workflows, MCP (Model Context Protocol) servers, and multi-agent orchestration patterns.
• Architect identity and authorization frameworks for AI agents operating in the client's environment: agent authentication, scoped permissions, audit trails, and runtime governance aligned to emerging CISA guidance on agentic systems.
• Assess and govern the identity security posture of AI-assisted workflows — including agent-to-agent communication, tool-calling permissions, data access boundaries, and session lifecycle management.
• Maintain current expertise on the fast-evolving NHI and agentic security vendor landscape — Clutch, Oasis, and emerging players — providing the client with informed, vendor-neutral advisory on platform selection and evolution.

Client Advisory & Technical Engagement

• Lead architecture deep dives, technical workshops, and whiteboarding sessions with the client's cyber team, platform engineers, and senior technology leadership — driving clarity, alignment, and decision momentum.
• Facilitate stakeholder alignment across cyber, cloud, application, and compliance teams on NHI standards, platform decisions, and implementation priorities.
• Produce high-quality architecture artefacts: reference architectures, current-state assessments, gap analyses, technology evaluation frameworks, and roadmap documentation suitable for CISO and board-level consumption.
• Serve as the day-to-day technical trusted advisor to the client's cyber team — the person they call when a complex NHI or agentic identity problem lands on their desk.

Business Relationship & Mindshare Development

• Build deep technical credibility and executive mindshare with the client's cybersecurity leadership — establishing Mphasis as the partner of choice for NHI and agentic identity implementation.
• Work closely with the Mphasis account team to translate technical relationships, advisory insights, and identified capability gaps into commercial opportunity on the implementation side.
• Represent Mphasis in client technology forums, architecture review boards, and vendor evaluation processes — amplifying the Mphasis IAM practice brand within the client organization.
• Contribute to Mphasis thought leadership on NHI and agentic identity — white papers, POVs, and conference participation — that strengthens the practice's market position.

What You Bring

Experience & Domain Expertise (Required)

• 10+ years of progressive experience in IAM and cybersecurity engineering, with a foundation in enterprise identity architecture, access governance, and security operations.
• 4+ years of specialized hands-on experience in Privileged Access Management (PAM) and Non-Human Identity (NHI) — including service account governance, secrets management, certificate lifecycle management, and machine identity programs at enterprise scale.
• Demonstrated hands-on experience with next-generation NHI platforms: Clutch and/or Oasis — including deployment, configuration, integration, and operational governance in a regulated financial services environment.
• Deep working knowledge of CyberArk (Defender / Sentry / Conjur) and Delinea (Secret Server / Privilege Manager) — implementation, architecture, and program governance across complex, multi-cloud estates.
• Experience with SailPoint (IdentityNow or IdentityIQ) and its role in governing non-human identities alongside human identity lifecycle management.
• Hands-on experience with secrets management platforms: HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, and/or Google Cloud Platform Secret Manager in production environments.
• Deep understanding of agentic AI architectures — AI agent design patterns, MCP server security, multi-agent orchestration, tool-calling authorization, and the identity and access challenges unique to autonomous AI systems.
• Strong fluency in cloud identity and access management across AWS (IAM roles, STS, instance profiles), Azure (Managed Identities, Service Principals, Entra ID), and Google Cloud Platform (Service Accounts, Workload Identity Federation).
• Prior experience in financial services — banking, wealth management, or capital markets — with working familiarity with SEC, FINRA, SOX, and PCI-DSS compliance requirements as they apply to identity and access.

Frameworks & Standards (Required)

• Working fluency with NIST Cybersecurity Framework (CSF 2.0), NIST SP 800-207 (Zero Trust Architecture), and CISA guidance on Non-Human Identity security and agentic systems.
• Understanding of identity-related OWASP standards, CIS Controls, and MITRE ATT&CK techniques relevant to machine identity compromise (credential theft, lateral movement via service accounts, secrets sprawl).

Certifications (Required)

• CISSP (Certified Information Systems Security Professional) or CISM (Certified Information Security Manager) — active certification required.
• CyberArk Defender, CyberArk Sentry, or equivalent PAM platform certification strongly preferred.

Client-Facing & Advisory Skills (Essential)

• Proven ability to lead architecture deep dives and technical whiteboarding sessions with senior client stakeholders — translating complex identity and security concepts into clear, actionable strategy.
• Strong executive communication skills: ability to produce and present architecture artefacts, risk assessments, and technology roadmaps to CISOs, Chief Architects, and board-level audiences.
• Comfortable operating as an embedded trusted advisor in a client environment — building relationships independently, navigating organizational dynamics, and driving alignment across cross-functional stakeholder groups.
• Collaborative mindset with the ability to work within the FDE model — client-embedded while maintaining a strong connection to the Mphasis IAM practice, methodology, and delivery resources.

Preferred Qualifications

• Experience with Kubernetes and container security — workload identity, SPIFFE/SPIRE, and service mesh identity (Istio / Linkerd) in production environments.
• Prior experience building or advising on AI/ML security programs with specific attention to model access control, training data governance, and inference-time identity controls.
• Familiarity with SCIM, SAML, OAuth 2.0, and OpenID Connect as they apply to machine-to-machine authentication and authorization patterns.
• Active participation in industry bodies or working groups related to NHI, agentic security, or identity standards (e.g., IDPro, OpenID Foundation, CISA working groups).
• Experience operating in a consulting or FDE model — client-embedded, outcome-accountable, with experience growing engagements through technical credibility.