Cloud IAM Architect, VP

Job Summary

The Cloud IAM Architect is a senior architecture role responsible for defining authorization and access patterns for cloud platforms, with a primary focus on AWS and multi-account environments. This role ensures cloud platforms conform to global IAM standards while enabling secure, scalable, and auditable access across multiple accounts, environments, and regions.

Key Responsibilities

• Cloud Authorization Architecture
  Define and govern AWS IAM Identity Center architecture and permission-set standards.
  Establish global role design patterns (e.g., reader, operator, administrator) aligned to least privilege.
  Drive evolution of authorization models from RBAC toward ABAC / PBAC where appropriate.

• Multi-Account & Multi-Region Access
  Architect secure cross-account access strategies in AWS Organizations and Control Tower environments.
  Ensure permission models respect Service Control Policies (SCPs) and organizational guardrails.
  Design environments-specific access patterns (sandbox, development, staging, production).

• Infrastructure-as-Code & Platform Enablement
  Define Terraform-based IAM patterns for permission sets, role assignments, and policy enforcement.
  Integrate IAM standards into AWS Control Tower and account-vending workflows.
  Partner with platform and DevSecOps teams to embed IAM by design.

• Governance, Metrics & Risk Alignment
  Partners with IAM Governance teams to define and consume cloud IAM metrics, including role reuse, exception volume, and privilege concentration.
  Ensure cloud authorization models are auditable, regulator-defensible, and consistent across regions.
  Provide architectural guidance and review for cloud onboarding initiatives.

Skills & Capabilities

• Required Skills (Must Have)
  Deep experience designing AWS IAM authorization models in multi-account environments.
  Strong hands-on architectural knowledge of AWS IAM Identity Center and permission sets.
  Expertise in RBAC design, with working knowledge of ABAC / PBAC concepts.
  Experience with AWS Organizations, SCPs, and permission boundaries.
  Understanding of Control Tower landing zone governance and inheritance models.
  Experience designing IAM solutions using Terraform or equivalent IaC tools.
  Ability to standardize and template IAM controls for repeatable use.
  Strong ability to define reusable patterns and influence adoption across teams.
  Experience collaborating with cloud engineering, platform, security, and audit stakeholders.

• Suggested Skills (Strongly Preferred)
  Experience operating IAM in regulated or highly controlled environments.
  Familiarity with environment-specific role design (dev vs. sandbox vs. prod).
  Experience integrating workforce identity (e.g., Entra ID) with cloud authorization.
  Experience defining or consuming IAM metrics to drive continuous improvement.

• Optional Skills (Nice to Have)
  Exposure to multi-cloud IAM concepts beyond AWS.
  Familiarity with DevSecOps or platform engineering operating models.
  Relevant cloud or security certifications (e.g., AWS, security architecture).