• Design and maintain IAM security architecture: directory services, federation, SSO (SAML/OIDC), MFA, conditional access, device trust • Implement identity lifecycle automation (joiner/mover/leaver), birthright roles, and SCIM-based provisioning/deprovisioning • Define RBAC/ABAC models; perform access reviews, role mining, and segregation-of-duties analyses • Integrate identity governance platforms (where applicable) with HRIS/ERP and downstream applications • Engineer privileged access management (PAM) solutions (Examples: CyberArk/BeyondTrust) including JIT elevation and session recording • Secure service and machine identities, secrets, and certificates; enforce rotation and attestation • Develop identity security monitoring and anomaly detection (e.g., Identity Protection, risk-based access); integrate with SIEM/XDR for response • Support Zero Trust identity strategy, including strong authentication, device trust, and continuous access evaluation • Support compliance audits (where applicable) with access certification evidence and control narratives • Troubleshoot complex federation and authorization issues; provide tier-3 support and root-cause analysis • Document standards, patterns, and runbooks; advise application teams on secure integration