Principal IAM/PAM Security Architect

Define and maintain security architecture and standards across Active Directory, Microsoft Entra ID, Okta, and multi-cloud identity (AWS, Azure, GCP, OCI), covering authentication, authorization, and lifecycle controls.

• Serve as the architectural authority for identity security decisions, aligning platform and cloud teams to enterprise standards across a large, complex identity environment.

• Lead architecture reviews and risk assessments for new identity integrations, platform migrations, and M&A activity.

•

Define enterprise standards for Agentic Identity — governance, lifecycle, authentication, and authorization for AI agents and other non-human identities, including provisioning, scoped entitlements, and deprovisioning.

• Track the evolving agentic AI and non-human identity landscape and advise leadership on emerging risks, standards, and vendor capabilities.

•

Define security requirements for and lead enterprise-wide implementation of the Delinea PAM platform (Secret Server, Privilege Manager).

• Design privileged access controls — least privilege, JIT/JEA, session monitoring, credential rotation — across on-premises and cloud environments, and oversee onboarding of privileged accounts and systems.

• Produce audit-ready evidence of PAM controls aligned to frameworks such as SOX, HIPAA, PCI, and ISO 27001.

•

Own enterprise policy and lifecycle standards for all secrets — API keys, OAuth/OATH tokens, service account credentials, and certificates — including vaulting, rotation, and secure distribution.

• Drive detection and remediation of hardcoded, unmanaged, or leaked secrets across source code, configuration, and CI/CD pipelines.

• Establish metrics and reporting to track secrets governance maturity and compliance across the organization.

•

Participate in and help lead architecture review boards, governance forums, and risk committees for identity and privileged access.

• Maintain reference architectures, standards documentation, and roadmaps for identity, PAM, and secrets governance.

• Advise stakeholders on identity risk and control design for new initiatives, and mentor engineers implementing identity, PAM, and secrets solutions.

• Complete all responsibilities as outlined in the annual performance review and/or goal setting

• Complete all special projects and other duties as assigned.

• Must be able to perform duties with or without reasonable accommodation.

This job description is intended to describe the general nature and level of work being performed and is not to be construed as an exhaustive list of responsibilities, duties and skills required. This job description does not constitute an employment agreement and is subject to change as the needs of Cotiviti and requirements of the job change.

• Bachelor’s degree in a technology discipline or equivalent professional experience.

• 8+ years of experience in identity and access management, privileged access management, or security architecture roles, including experience across large, complex enterprise environments.

• Demonstrated experience designing security standards across hybrid identity environments (Active Directory, cloud IAM, and SaaS identity providers).

• Hands-on experience with a PAM platform (Delinea preferred) at an architecture or lead engineering level.

•

PowerShell, Python, and REST APIs for identity/PAM/secrets lifecycle automation; experience embedding these controls into CI/CD pipelines and infrastructure-as-code (Terraform, ARM, CloudFormation).

• Strong analytical and architectural problem-solving skills, with the ability to translate complex, multi-domain identity environments into clear standards and communicate architecture and risk decisions to technical and business stakeholders.

• Relevant security certifications preferred (e.g., CISSP, CISM, SABSA, CCSP).

• Communicating with others to exchange information.

• Assessing the accuracy, neatness, and thoroughness of the work assigned.

• Problem-solving and thinking critically.

• Completing tasks independently.

• Interpreting data.

• Making timely decisions in the context of a workflow.

• Maintaining focus.

• Must be able to provide high-speed internet access / connectivity and office setup and maintenance.

• Must be able to provide a dedicated, secure work area.

• Remaining in a stationary position, often standing or sitting for prolonged periods.

• Repeating motions that may include the wrists, hands, and/or fingers.

• No adverse environmental conditions expected.

Base compensation ranges from $160,000 to $190,000 per year. Specific offers are determined by various factors, such as experience, education, skills, certifications, and other business needs. This role is eligible for discretionary bonus consideration. Cotiviti offers team members a competitive benefits package to address a wide range of personal and family needs, including medical, dental, vision, disability, and life insurance coverage, 401(k) savings plans, paid family leave, 9 paid holidays per year, and 17-27 days of Paid Time Off (PTO) per year, depending on specific level and length of service with Cotiviti . For information about our benefits package, please refer to our Careers page.