Design Specialist

We are looking for an experienced and motivated IAM Solution Architect / Design SME – Zero Trust & Cloud Identity to support Project Orbit – NextGen, a global Identity and Access Management transformation programme. The successful candidate will provide end-to-end engineering and technical design leadership for the IDAM 2.0 programme, translating business, security, regulatory, and operational requirements into secure, scalable, resilient, and supportable identity solutions. Department: Identity and Access Management (IAM)

Responsibilities

• Produce High-Level Designs and Low-Level Designs for enterprise identity capabilities.
• Define end-to-end technical solutions across business, application, data, infrastructure, and security domains.
• Translate business, security, regulatory, and non-functional requirements into practical technical solutions.
• Develop reference architectures, reusable patterns, design standards, and technical guidance for the IAM programme.
• Define integration patterns between identity platforms, applications, infrastructure, and third-party services.
• Design cloud-native identity and security solutions using Google Cloud Platform and Kubernetes.
• Define authentication, authorization, federation, and identity lifecycle architectures.
• Design capabilities for human identity, non-human identity, agent identity, and workload identity.
• Define Zero Trust architectures, trust boundaries, and identity-first security principles.
• Design API security, service-to-service authentication, workload authentication, and secure integration patterns.
• Develop event-driven integration architectures using messaging, asynchronous processing, and distributed services.
• Design Policy Decision Point and Policy Enforcement Point architectures using Policy-as-Code, OPA, or Cedar.
• Define secrets management, certificate lifecycle, PKI, and certificate-based authentication patterns.
• Design high-availability, disaster-recovery, resilience, scalability, performance, and observability architectures.
• Produce Architecture Decision Records, design documentation, technical options, and solution assurance materials.
• Support Architecture Review Boards, Design Authorities, technical steering groups, and governance forums.
• Review and assure technical designs delivered by internal teams, implementation partners, and third-party suppliers.
• Identify and manage technical risks, assumptions, constraints, dependencies, and design deviations.
• Collaborate with Enterprise Architecture to ensure alignment with the strategic target architecture.
• Work with Product Owners to refine technical requirements, product priorities, and delivery outcomes.
• Support engineering teams throughout implementation, testing, deployment, and production readiness.
• Mentor engineers and promote secure engineering, DevSecOps, documentation, and architecture best practices.
• Evaluate new technologies and vendor products against programme requirements.
• Contribute to roadmap planning and future-state IAM architecture. Required Skills & Experience
• Extensive experience in Enterprise Identity and Access Management or Identity Security Architecture.
• Proven experience producing HLDs, LLDs, solution designs, architecture patterns, and technical decision records.
• Strong understanding of authentication, authorization, identity federation, and identity lifecycle management.
• Hands-on architecture experience with OIDC, OAuth 2.0, SAML, SCIM, and JWT.
• Experience designing human identity, non-human identity, agent identity, and workload identity solutions.
• Strong knowledge of Zero Trust Architecture and identity-first security principles.
• Experience designing cloud-native solutions using GCP and Kubernetes.
• Strong understanding of API architecture, API security, service-to-service authentication, and workload authentication.
• Experience with event-driven architecture, messaging, asynchronous processing, and distributed systems.
• Experience with Policy-as-Code, Policy Decision Points, Policy Enforcement Points, OPA, or Cedar.
• Experience designing secrets management, certificate lifecycle, PKI, and certificate integration patterns.
• Strong knowledge of high availability, disaster recovery, resilience, scalability, performance, and observability.
• Experience working with Enterprise Architecture, Security, Engineering, Operations, Product, Risk, Compliance, and third-party suppliers.
• Experience supporting architecture governance, design authorities, technical reviews, and solution assurance.
• Experience working on large-scale technology, cybersecurity, cloud, or IAM transformation programmes.
• Strong technical leadership, stakeholder management, communication, facilitation, and documentation skills.
• Experience working within a regulated banking or financial-services environment. Preferred Experience
• Experience with GCP services such as GKE, Cloud IAM, Workload Identity, API Gateway, Pub/Sub, Cloud Run, or Secret Manager.
• Familiarity with IAM and security platforms such as Microsoft Entra ID, SailPoint, CyberArk, Okta, Ping Identity, ForgeRock, or Saviynt.
• Experience with HashiCorp Vault, certificate authorities, PKI platforms, or privileged access management.
• Experience with service mesh technologies and cloud-native security controls.
• CISSP, CISM, SABSA, TOGAF, CCSP, Google Cloud, Kubernetes, or other relevant certifications.
• Experience leading architecture or technical design forums and mentoring architects or engineering teams