Lead Security Consultant IAM/PAM

Project overview

At virtual7, we combine our technological expertise with a deep understanding of our clients' needs. Through tailor-made solutions, we create real added value for our framework contract partners in public administration. We are currently looking for a Lead Security Consultant IAM/PAM (m/f/d) for one of our clients.

YOUR MISSION

Our client has a need in the management and handling of IAM/PAM.

• Project location: Bonn
• Period: November 16, 2026 to December 31, 2026
• Work mix: 30 days remote/ 4 days on-site
• Important: Remote work only possible within Germany
• Important: Project language is German
• Important: Willingness for SÜ2 according to § 9 SÜG (Classified Information/Sabotage Protection)
• Extension for 2027 possible

Responsibilities

MUST-HAVES FOR THIS POSITION

NICE TO-HAVES FOR THIS POSITION

If you are interested and currently have free capacity, we look forward to your application. Our recruiting team with Alicja Okuniewicz, Anna-Lena Röcker, Jörg Becker – looks forward to talking with you.

virtual7 Recruiting Team

Mail: *@*.de

JobLink: https://virtual7jobs.recruitee.com/o/lead-security-consultant-iampam-mwd

• Recording the existing directory, login, and authorization landscape with the responsible departments, assessing its viability
• Design of the self-operated identity architecture, including the consolidation direction of directory services
• Federation between zones for internal and external stakeholders; own certificate management, including revocation information and time basis
• Authentication strategy with multi-level and passwordless methods that do not rely on manufacturer-operated services
• Design of the role and authorization model, including the identities of automation and services
• Lifecycle of identities in conjunction with HR processes, also with time-delayed effectiveness in separated zones
• Concept and pilot implementation for privileged access, including time-limited rights assignment, session traceability, and emergency access without remote support
• Coordination with employee representatives and data protection; scaling roadmap with order of priority based on risk and effort per unit
• min. 6 years of experience with the design and introduction of identity and authorization management in a heterogeneous organization, with responsibility for results
• min. 6 years of experience with self-operated directory and federation services, as well as the underlying methods: Kerberos, LDAP, SAML, OIDC, OAuth 2.0, SCIM. Experience must not be exclusively based on a manufacturer-operated identity service
• min. 6 years of experience with the introduction of multi-level authentication without dependence on manufacturer notification services
• min. 6 years of experience with the introduction of controlled privileged access via heterogeneous target systems in self-operation
• min. 6 years of experience with emergency access procedures for environments
• min. 6 years of experience with certificate management
• min. 6 years of experience with the design of roles and authorization models, derivation from authorization data, and realistic assessment
• min. 6 years of experience in handling personal, technical, and machine identities, including identities for automated delivery
• min. 6 years of experience in conjunction with HR processes, as well as experience in coordinating co-determination regulations.
• min. 6 years of experience with Active Directory, FreeIPA, Univention Corporate Server, Keycloak, Shibboleth, ADFS
• min. 6 years of experience with privacyIDEA, LinOTP, FIDO2/WebAuthn tokens such as YubiKey or Nitrokey
• min. 6 years of experience with CyberArk, Delinea, BeyondTrust, WALLIX, Teleport, HashiCorp Boundary
• min. 6 years of experience with midPoint, SailPoint, One Identity, Omada
• min. 6 years of experience with EJBCA, Dogtag, step-ca, Microsoft ADCS, cert-manager
• min. 6 years of experience with SPIFFE/SPIRE
• Knowledge of context-dependent access control from the public cloud environment
• Identities and federation in the provider context
• Passwordless and hardware-bound login methods in existing systems

Project details

• Start: 2026-11
• Duration: 2 Monate
• Remote: hybrid
• Location: Bonn, Deutschland, DE
• Languages: German