Job Description
Job Title: Identity & Access Management Architect
\n
Pay rate: $78.19 - $103.41/hr.
\n
Location: Palo Alto, CA (Hybrid)
\n
Zip Code: 94304
\n
Duration: 6 Months
\n
Start Date: Right Away
\n
Keywords: #PaloAltoJobs; #SeniorTechnicalProgramManagerjobs; #Identity&AccessManagementArchitect
\n
International travel will be required to Serbia
\n
\n
\n We provide a competitive pay and benefits package. This position is offering a pay range of $78.19 - $103.41/hr. however, Belcan considers several factors when extending an offer, including but not limited to education, experience, geographic location, and discipline. Benefits offered may include health care, dental, vision, life insurance; 401(k); education assistance; paid time off including PTO, holidays, and any other paid leave required by law
\n
\n
.
\n Job Summa
\n
ryWe are seeking a hands-on IAM Architect to lead our enterprise workforce identity migration from Microsoft Entra ID to Okta (~1,800 users), targeting a federation cutover in Q3 2026. You will own the migration architecture end-to-end ? federation design, app integrations, cutover, and stabilization ? working alongside our internal Enterprise Cybersecurity team and an external implementation partner. Beyond the migration, you'll help build and operate our identity ecosystem, with the opportunity to contribute to a custom identity orchestration and governance platform. This is a 6-month contract with strong potential for conversion to a full-time rol
\n
\n
e.
\n Key Responsibilit
\n
iesOkta Migration & IAM Operations (co
\n
re)* Lead technical architecture for the Entra ID to Okta workforce identity migration: federation design, app integration sequencing, cutover planning, rollback strategy, and hyperc
\n
are* Design and build SSO/SAML/OIDC integrations across the enterprise application portfolio; architect multi-tenant deployment (separate US/EU tenants) to meet regional data requireme
\n
nts* Architect lifecycle management and provisioning workflows (HR-driven joiner/mover/leaver), including SCIM integrati
\n
ons* Define and implement MFA, adaptive authentication, and device assurance policies aligned to a zero-trust road
\n
map* Serve as technical counterpart to the implementation partner: review designs, challenge assumptions, hold delivery quality to stand
\n
ard* Maintain and operate the Okta environment post-cutover: policy tuning, integration onboarding, incident support, and operational runbo
\n
oks* Produce audit-ready documentation for an ISO 27001 / TISAX-aligned control environm
\n
entIdentity Orchestration & Governance (seconda
\n
ry)* Contribute to the design and build of a custom identity orchestration layer (Databricks or equivalent): attribute-driven provisioning, ABAC policy models, JIT privileged access, anomaly detection, automated deprovisioning, and audit/recertification capabilit
\n
ies* Support integration of identity and authorization event logs into the cybersecurity S
\n
\n
IEM
\n Required Qualificat
\n
ions* 7+ years in identity and access management, with 3+ years hands-on Okta experience building, deploying, and maintaining Okta Workforce Identity Cloud environm
\n
ents* At least one completed enterprise migration from Entra ID / Azure AD to Okta as architect or technical
\n
lead* Deep expertise in SAML, OIDC, OAuth 2.0, SCIM, and directory integration (AD/Entra ID hybrid scenar
\n
ios)* Experience operating and administering Okta in production: policy management, app integrations, lifecycle workflows, troubleshoo
\n
ting* Experience designing MFA and adaptive access policies at enterprise s
\n
cale* Strong documentation skills; able to produce audit-ready artif
\n
acts* Proven ability to work alongside system integrators while retaining architectural owner
\n
\n
ship
\n Preferred Qualifica
\n
tions* Okta Certified Consultant or Okta Certified Arch
\n
itect* Experience building custom identity automation or governance tooling using Python/SQL, event-driven pipelines, and
\n
APIs* Working knowledge of data platforms (Databricks, Spark, or comparable) for event ingestion and proce
\n
ssing* Experience with ABAC/policy-based authorization models and JIT/ephemeral privileged access patterns i
\n
n AWS* SIEM integration experience (log normalization, detection engineering for identity sig
\n
nals)* Familiarity with IGA platforms, PAM solutions, and enterprise password man
\n
agers* Experience in regulated or automotive environments (TISAX, ISO 27001, NIST 80
\n
\n
0-53)
\n Engagement D
\n
etails* Start date: ASAP; interviews conducted on a rolling
\n
basis* Reports to: Senior Manager, Enterprise Cyberse
\n
curity* Contract-to-hire: strong performers will be considered for a full-time Identity Engineering role at the conclusion of the initia
\n
\n
l term
\n Belcan is a leading provider of qualified personnel to many of the world's most respected enterprises. We offer excellent opportunities for contract, temporary, temp-to-hire, and direct assignments. We are the employer of choice for thousands worldwide. For more information, please visit our website at Bel
\n
can.com