Senior IAM Architect

Who We Are

Xtensys is a rapidly growing managed service provider delivering innovative technology solutions to health systems, beginning in New York and expanding nationwide. Owned by two industry leaders with a strong focus on advancing rural and community healthcare, Xtensys is executing several major initiatives and scaling quickly. With a team of more than 500 professionals, we are building a people-centered culture rooted in collaboration, innovation, and strategic thinking.

How We Work:

• East Coast Alignment: Our core operational and collaboration hours follow the Eastern Time Zone (ET), keeping our workflows synchronized with our primary clients and systems.

Why Join Us?

• Mission-Driven Work: You are the "bridge" ensuring technology serves health systems and their patients when they need it most.
• Autonomy & Ownership: We trust you. You’ll lead projects, define success, and manage complexities with total support.
• A Culture of Innovation: Have a fresh perspective? We want it. We encourage risk-taking and continuous improvement.
• Continuous Growth: We fuel your "restless curiosity" with opportunities to expand your skillset and mentor others.

Job Requistion:

Work Arrangement:

Remote

Compensation Range:

$135,000.00 - $150,000.00 per year

The Role:

Your Mission: The Senior IAM Architect is a senior technical lead responsible for designing, documenting, and driving the maturation of identity and access management capabilities across the Xtensys environment and its customers. This is not a purely advisory role. The right candidate will own the current state, define the future state, and build the steppingstones between them, producing deliverables that are equally credible to a CISO and a systems administrator.

This role requires a high degree of independent judgment and self-direction. The IAM Architect is expected to proactively identify process gaps, access anomalies, governance risks, and operational inefficiencies without waiting to be directed. When something is wrong or could be improved, the expectation is that you investigate it, document your findings, and bring a recommendation, not just an observation. The IAM Manager should be learning about problems and proposed solutions together, not assigning discovery work.

The role operates across two horizons simultaneously. In the near term, the Architect will optimize existing tooling, including ManageEngine ADManager Plus and ManageEngine M365 Manager, to reduce manual lifecycle work, improve governance controls, and expand automation coverage across on-premises and cloud-connected environments. In the longer term, the Architect will lead the continued maturation of the IAM program including enterprise RBAC and access certification programs built on the ManageEngine platform suite.

This role may mentor or provide technical direction to junior IAM team members but does not carry formal supervisory responsibility at this time.

What You'll Do Day-to-Day:

Proactive Governance and Anomaly Detection:

• Continuously monitor identity systems, access patterns, lifecycle workflows, and audit logs for anomalies, policy violations, and process gaps without waiting for issues to be escalated.

• Independently investigate anomalies, document root cause findings, and implement or recommend corrective actions with minimal direction.

• Establish and maintain proactive monitoring practices including stale account detection, orphaned access identification, offboarding compliance tracking, and privilege creep analysis.

• Maintain a standing risk and improvement register for the IAM program, self-updating it as new findings are identified and tracking items through resolution.

Current State Assessment and Documentation:

• Assess, document, and baseline all primary IAM workflows including Joiner, Mover, Leaver, Leave of Absence, and Reactivation processes across all Xtensys-managed domains.

• Identify and document manual process steps, tooling gaps, compliance exposure, and quality control risks in existing workflows.

• Maintain living documentation of the IAM environment including architecture diagrams, process flows, and system integration maps.

Identity Lifecycle Management:

• Design, implement, and optimize Joiner, Mover, and Leaver workflows across on-premises Active Directory, Microsoft Entra ID, and integrated SaaS platforms.

• Reduce manual lifecycle work in the current ManageEngine ADManager Plus environment through targeted workflow automation, role template optimization, and Jira integration improvements.

• Design and implement integration improvements between lifecycle event sources — including Jira and Workday — and ManageEngine ADManager Plus for on-premises Active Directory environments and ManageEngine M365 Manager for Microsoft 365 environments, covering lifecycle event triggering, attribute mapping, and provisioning automation across both platforms independently.

• Partner with business stakeholders, HR, clinical operations, and application owners to gather access and provisioning requirements, translating business needs into IAM workflow designs and platform configurations.

• Define and enforce offboarding standards including cross-domain account disablement and privileged account closure within defined SLAs.

ManageEngine Platform Maturation (ADManager Plus & M365 Manager):

• Lead the ongoing optimization and expansion of ManageEngine ADManager Plus for on-premises Active Directory environments, including role-based template development, delegated workflow design, provisioning automation, and Jira and Workday integration improvements.

• Implement and mature ManageEngine M365 Manager for Microsoft 365 environments, extending lifecycle management, governance reporting, and access controls across Microsoft 365 and Entra ID with equivalent Jira and Workday integration coverage.

• Design and implement access certification campaigns, attestation workflows, and governance reporting within each platform independently, maintaining consistency in standards and controls across both environments.

• Identify gaps in current platform coverage and develop a roadmap for expanding automation and governance capabilities across both tools.

Identity Governance and Access Control:

• Design and implement enterprise RBAC models across Active Directory and Entra ID.

• Conduct and support periodic access reviews, recertifications, and audit evidence collection across all managed identity systems.

• Develop and enforce IAM policies covering account standards, naming conventions, attribute requirements, and lifecycle SLAs.

• Partner with cybersecurity and compliance teams to ensure IAM controls satisfy HIPAA, NIST 800-53, and organizational audit requirements.

Technical Operations and Escalation:

• Serve as the senior technical escalation point for identity-related service tickets, provisioning failures, and access disputes.

• Monitor IAM infrastructure for performance, availability, and security anomalies; proactively identify and remediate issues.

Who You Are & What You'll Bring:

Proven Track Record:

• 8+ years of hands-on IAM experience with a combination of design, implementation, and operational ownership of enterprise identity systems.

• Demonstrated experience producing current state assessments, IAM program roadmaps, and executive-facing communications for senior leadership audiences.

• Experience designing and managing Joiner, Mover, Leaver workflows in complex multi-domain or post-merger environments.

• Experience with Workday-to-Active Directory integration including HR-driven provisioning, attribute mapping, and lifecycle synchronization.

• Experience implementing or operating in a healthcare or regulated industry environment with HIPAA compliance obligations.

Technical Skills & Experience:

• Deep expertise with Microsoft Active Directory and Microsoft Entra ID including hybrid identity, Conditional Access, and delegated administration.

• Strong PowerShell scripting capability for lifecycle automation, audit log analysis, group membership management, and reporting.

• Proficiency with ManageEngine ADManager Plus including role-based templates, delegated workflows, and provisioning automation.

• Experience with ManageEngine M365 Manager including license management, mailbox provisioning, and Microsoft 365 governance capabilities.

• Experience with SAML, OAuth 2.0, OIDC, SCIM, and LDAP protocols in enterprise integration contexts.

• Working knowledge of Jira for service ticket workflow management and IAM request routing.

• Experience designing IAM programs in post-merger or multi-entity environments with multiple Active Directory domains and distinct identity namespaces.

Certifications:

• ManageEngine Certified Professional or equivalent IGA platform certification preferred.

• Microsoft Identity and Access Administrator (SC-300) or equivalent Entra ID certification preferred.

Work Schedule & Additional Requirements:

On-call support may be required approximately once every six weeks to assist with escalations and provide after-hours support as needed.

Occasional travel (5% or less) may be required for team meetings and collaboration.

Physical Readiness:

Sedentary work requiring exertion of up to 10 pounds of force occasionally. The role involves sitting most of the time, with occasional walking and standing as needed.

About Xtensys Connected Health Solutions

We are new but mighty. Xtensys, a recently established managed service provider, delivers cutting-edge technology to health systems, starting in NY and expanding beyond. Owned by two industry leaders focused on innovation in rural and community health, we are rapidly growing with several major initiatives underway. We seek talented professionals to join our team of 500 and support our exciting journey. We value people and are building a culture to match. If you're a collaborative, innovative, and strategic leader, we’d love to talk.