Solution Architect – Identity & Access Management

Project overview

Key Data:

Service Description:

• Role: Solution Architect – Identity & Access Management
• Period: asap until 31.12.2026 (extension likely until 12.2027)
• Utilization: 100% / Full-time
• Location: mainly remote & on-site in Germany as needed
• Analysis & evaluation of the directory, authentication, and authorization landscape
• Conception of a self-operated Identity & Access Management architecture for heterogeneous & partly isolated environments
• Development of a consolidation and federation strategy for existing directory services and connection to the target platform's access management
• Conception & introduction of multi-factor and passwordless authentication methods without dependency on vendor-operated services
• Design of identity federation between different zones & with internal and external stakeholders
• Conception & integration of a proprietary certificate management including revocation information and time synchronization in isolated zones
• Development of a role and authorization model for user, technical, and machine identities & automated delivery processes
• Design of the complete identity lifecycle in conjunction with HR processes, esp. provisioning, modification & revocation of authorizations
• Conception and piloting of PAM including time-limited authorization, session traceability & emergency access
• Conception of recertification processes and coordination with data protection & employee representation
• Practical implementation and validation of the developed IAM & PAM concepts in the pilot area including at least one isolated zone
• Development of a risk-based roadmap for subsequent transfer to the overall landscape

Requirements

Must-haves:

Should-haves:

Please send us your CV to: sina.neuwoehner AT deedcon.de

• 6–10 years of experience in the conception and implementation of Identity & Access Management and authorization management in large and heterogeneous organizations with own responsibility for results
• 6–10 years of experience with self-operated directory and federation services as well as profound knowledge of Kerberos, LDAP, SAML, OIDC, OAuth 2.0 and SCIM; experience must not be exclusively based on vendor-operated identity services
• 6–10 years of experience with the implementation of multi-factor authentication without dependency on vendor-side notification services, especially hardware-bound methods or self-operated one-time password services
• 6–10 years of experience with issuance, replacement, and return processes for authentication or hardware tokens
• 6–10 years of experience with the practical implementation & execution of controlled privileged access (PAM) across heterogeneous target systems in self-operation
• 6–10 years of experience with emergency access procedures for environments without remote access or available vendor support
• 6–10 years of experience with proprietary certificate management including revocation information & time synchronization in isolated or not permanently connected zones
• 6–10 years of experience in the conception of role and authorization models including derivation from existing authorization data as well as authorization management and recertification
• 6–10 years of experience in handling personal, technical, and machine identities including identities of automated build and delivery processes
• 6–10 years of experience in linking the identity lifecycle with HR processes as well as in coordinating co-determination regulations
• 6–10 years of relevant experience in the IAM/PAM environment as well as proven practical experience with tools from several of the following areas:
• Directory & Federation: Active Directory, FreeIPA, Univention Corporate Server, Keycloak, Shibboleth, ADFS or similar
• Multi-Factor Authentication: privacyIDEA, LinOTP, FIDO2/WebAuthn, YubiKey, Nitrokey or similar
• Privileged Access Management: CyberArk, Delinea, BeyondTrust, WALLIX, Teleport, HashiCorp Boundary or similar
• Authorization Management & Recertification: midPoint, SailPoint, One Identity, Omada or similar
• Certificate Management/PKI: EJBCA, Dogtag, step-ca, Microsoft ADCS, cert-manager or similar
• Machine and Workload Identities: SPIFFE/SPIRE or similar
• Context-dependent access control from the public cloud environment and transfer of corresponding approaches to self-operated infrastructures
• Identity & Federation in the provider context, esp. tenant separation and connection of client identities across zone boundaries
• Passwordless and hardware-bound authentication methods in existing IT landscapes
• Replacement and migration of established authorization management systems during ongoing operations
• Zero Trust architecture principles and their implementation or limitations in segmented and isolated environments
• Certification CISSP or vendor-specific certifications in the Identity & Access Management environment

Project details

• Start: ab sofort
• Duration: 4 Monate
• Location: DE
• Languages: German