IAM Architect

Start Date: ASAP
Work Model: Hybrid
Location: Downtown Toronto
(outside Union Station – TTC & GO accessible)
Dress Code: Business Casual A Great Place to Work

Who We Are

Founded in 1993, Kinross is a Canadian-based senior gold mining company with operations and projects in the United States, Brazil, Mauritania, Chile and Canada. Our focus on delivering value is based on our four core values of Putting People First, Outstanding Corporate Citizenship, High Performance Culture, and Rigorous Financial Discipline.

Mining responsibly is a priority for Kinross, and we foster a culture that makes responsible mining and operational success inseparable. Our values-based approach ensures that sustainability and our environmental, social and governance commitments are a core part of our strategy and plans for future growth. In line with our values, we also aim to build meaningful partnerships with all of our stakeholders, including communities, shareholders, employees, governments and suppliers.

Kinross maintains listings on the Toronto Stock Exchange (symbol: K) and the New York Stock Exchange (symbol: KGC).

Job Summary

The IAM Architect is accountable for the architecture, strategy, and design of the organization’s identity ecosystem, with primary ownership of the target-state architecture for Active Directory (AD), Microsoft Entra ID (formerly Azure AD), and the enterprise Identity Governance and Administration (IGA) platform. Sitting within the Enterprise Cyber team in IT, the Architect defines identity standards, reference architectures, and the multi-year IAM roadmap, provides technical leadership and mentoring to IAM engineers, and serves as the design authority for identity governance, hybrid identity, access management, Microsoft identity licensing, and identity data quality. As automation and AI take on routine identity tasks, the Architect shapes the organization’s identity fabric, ensuring security, resilience, interoperability, and compliance across hybrid and multi-cloud environments. The successful candidate combines deep technical credibility with architectural judgment: the ability to understand identity dependencies across infrastructure, cloud platforms, security controls, HR systems, and automations, and to evaluate the enterprise-wide impact of identity decisions. They will balance strategic architecture and governance with hands-on expertise in directory services, authentication protocols, identity governance, and automation, and will lead the cross-functional collaboration with HR, application owners, audit, and vendors needed to secure an increasingly autonomous, AI-driven enterprise.

Key Responsibilities

Architecture Leadership, Security & Governance

• Own the enterprise IAM architecture and multi-year roadmap, aligning identity capabilities with Enterprise Cyber strategy, business priorities, and regulatory requirements.
• Define and maintain identity standards, design patterns, and reference architectures for directory services, authentication, authorization, identity governance, and privileged access.
• Act as the design authority for identity solutions: lead architecture reviews, document architecture decisions, and govern exceptions through the established architecture review process.
• Provide technical leadership and mentoring to IAM administrators, reviewing designs, code, and configurations and raising overall team capability.
• Engage stakeholders and vendors (including Microsoft and Saviynt) on product direction, solution evaluations, escalations, and commercial and licensing discussions.
• Define and enforce identity security standards, hardening baselines, and Zero Trust principles across AD, Entra ID, and Saviynt.
• Support compliance, audit, and regulatory requirements through access certification, logging, SoD and policy enforcement, and own remediation of identity-related audit findings.
• Partner with security operations, infrastructure, DevOps/platform teams, HR, and application owners to embed identity standards and architecture review into projects across the enterprise.

Directory Services, Hybrid Identity & Microsoft Licensing

• Own Active Directory modernization, transformation, and future-state architecture, including forest, domain, trust, and OU design and the roadmap toward cloud-first identity in Microsoft Entra ID.
• Define the architecture and security baselines for on-premises Active Directory (domains, forests, trusts, Group Policy, DNS, sites & services) and Microsoft Entra ID, and guide engineers in operating and optimizing them.
• Design the hybrid identity architecture: Entra Connect / Cloud Sync topology, password hash sync / pass-through authentication, federation, and seamless SSO, including resilience and recovery design.
• Set the authentication strategy and Conditional Access framework, including MFA, passwordless authentication (e.g., Windows Hello for Business, FIDO2 security keys, passkeys), Privileged Identity Management (PIM), and Identity Protection.
• Design and enforce a tiered administration model for AD and Entra ID (Tier 0/1/2, privileged access workstations, and protected admin accounts) to protect privileged identities.
• Lead AD hygiene and modernization, including Group Policy rationalization, OU and delegation clean-up, remediation of legacy protocols and stale objects, and reduction of on-premises dependencies.
• Own Microsoft 365 and Entra ID license management for identity services, including Microsoft 365 and Entra ID Governance entitlements.
• Design group-based licensing and automate license assignment and removal through the identity lifecycle, so licenses follow joiner/mover/leaver events, role, and employee type.
• Monitor license utilization, reclaim unused or misassigned licenses, and resolve assignment errors and conflicts.
• Produce licensing reports and cost-optimization recommendations, and support renewals, true-ups, and compliance reviews with Procurement and Microsoft.

Identity Governance & Administration (IGA) and Identity Data Quality

• Identity Governance & Administration (IGA) and Identity Data Quality
• Own the architecture of the enterprise IGA platform (Saviynt), including connectors, workflows, and integrations with AD, Entra ID, the HR system of record, and downstream applications, and direct its continuous improvement.
• Design the end-to-end identity lifecycle with HR as the authoritative source of truth, covering joiner/mover/leaver processes, provisioning and deprovisioning, and contractor and non-employee identities, orchestrated through Saviynt and Entra ID.
• Design the access governance model: role-based access control (RBAC) and role models, entitlement catalogs, access certification and recertification campaigns, and segregation-of-duties (SoD) rules.
• Define birthright access, access request and approval workflows, and policy-driven provisioning rules, and ensure they are implemented consistently across platforms.
• Partner with audit, compliance, and application owners to design governance controls that meet regulatory and internal requirements, IT general controls, and ensure audit evidence is complete and repeatable.
• Architect Microsoft Entra ID Governance capabilities (access reviews, entitlement management and access packages, lifecycle workflows, and PIM for roles and groups) and define how they complement Saviynt.
• Design privileged access governance, including just-in-time elevation, approval and periodic review of privileged roles, and break-glass account controls.
• Define identity data quality standards and attribute governance, including data ownership, authoritative sources, and HR-to-AD, Entra ID, and Saviynt attribute mapping.
• Detect and remediate orphaned, duplicate, and stale accounts and inconsistent attributes (e.g., manager, department, location, employee type) through automated reconciliation.
• Establish identity data quality reporting and KPIs, and partner with HR and data owners to correct issues at the source and prevent recurrence.

Authentication, Authorization & Integration

• Define standards and patterns for SSO and application onboarding across SAML, OIDC, OAuth 2.0, and SCIM provisioning, and guide engineers through complex integrations.
• Design the integration of enterprise applications with Entra ID, AD, and Saviynt, and set governance for service principals, enterprise apps, app registrations, and API permissions.
• Define the governance model for machine and workload identities (service accounts, API keys, certificates, and secrets), with appropriate rotation and least-privilege controls.
• Automation, Resilience & AI Oversight
• Set the automation strategy and standards (PowerShell, Microsoft Graph API, Saviynt connectors and APIs, infrastructure-as-code) and oversee automation of identity lifecycle, licensing, and data quality workflows.
• Direct the use of AI and automation for routine identity and governance tasks while maintaining human oversight, validating AI-generated configurations and code, and intervening where nuanced judgment is required.
• Define resilience requirements for identity systems, lead resilience and chaos testing (e.g., directory outage, MFA bypass scenarios), and lead root-cause analysis and post-incident improvements.

Required Technical Skills

• Active Directory: Deep expertise in forest, domain, trust, and OU design, Group Policy, DNS, replication, FSMO roles, tiered administration, AD security hardening, hygiene, and recovery.
• Microsoft Entra ID: Conditional Access, MFA and passwordless authentication, PIM, Identity Protection, Entra ID Governance, app registrations, enterprise applications, dynamic groups, and group-based licensing; working knowledge of Microsoft 365 and Entra ID licensing (E3/E5, Entra ID P1/P2, Entra ID Governance).
• Identity Governance & Administration: Proven experience architecting and integrating an enterprise IGA platform, ideally Saviynt (or SailPoint, One Identity, or equivalent), including connectors, lifecycle workflows, access certifications, RBAC, SoD controls, HR-driven provisioning, and identity attribute mapping and reconciliation; familiarity with Microsoft Entra ID Governance (access reviews, entitlement management, lifecycle workflows).
• Hybrid Identity: Entra Connect / Cloud Sync topology design, federation (AD FS or third-party), hybrid join scenarios, and migration toward cloud-first identity.
• Protocols: Strong working knowledge of SAML, OIDC, OAuth 2.0, SCIM, Kerberos, and LDAP — including the ability to troubleshoot complex integration failures.
• Automation & Scripting: PowerShell (advanced), Microsoft Graph API, Saviynt connector and API integration, and infrastructure-as-code (e.g., Terraform), applied to lifecycle, licensing, and reconciliation automation.
• Security & Architecture: Zero Trust, least privilege, privileged access management, and identity threat detection, together with architecture practices such as reference architectures, design standards, and architecture decision records.
• Emerging / AI-era skills (preferred): AI agent and workload identity governance, human-AI orchestration, identity data modeling, and validation of AI-generated identity configurations.

Required Soft Skills

• Strategic judgment — ability to make sound decisions in high-stakes, ambiguous, and non-routine identity scenarios that automation cannot resolve.
• Cross-functional influence & collaboration — works effectively across security, DevOps, HR, compliance, audit, and application teams; influences senior stakeholders and vendors and translates technical identity concepts for non-technical audiences.
• Problem-solving & root-cause analysis — strong analytical and troubleshooting skills, especially under incident pressure.
• Critical Thinking — Analyzes information objectively, challenges assumptions, and makes well-reasoned decisions based on evidence and sound judgment.
• Design Thinking — Applies a human-centered, creative approach to understand problems, generate innovative solutions, and design identity experiences that are both secure and easy to use.
• Communication — clear written and verbal communication, including architecture documentation, roadmaps, and executive-level stakeholder engagement.
• Adaptability & continuous learning — thrives in a rapidly changing environment; embraces upskilling and AI fluency as the role evolves.
• Leadership, ownership & accountability — mentors and develops administrators, sets quality standards, exercises autonomy, anticipates risk, and follows through on outcomes.
• Ethical reasoning — applies sound judgment to access, trust, and governance decisions in an AI-driven enterprise.

Qualifications and Skills

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or equivalent experience.
• 10+ years of experience in identity and access management, including deep hands-on experience with Active Directory and Microsoft Entra ID in enterprise/hybrid environments and recent experience in an IAM architecture or technical lead role.
• Demonstrated experience designing and implementing an enterprise IGA platform (Saviynt preferred; SailPoint or equivalent considered), including HR-driven lifecycle integration.
• Track record of owning identity architecture and roadmaps, leading complex hybrid identity or Active Directory modernization initiatives, and mentoring engineers.
• Experience managing Microsoft 365 and Entra ID licensing at enterprise scale and leading identity data quality or reconciliation programs.
• Experience working in regulated or audited environments (e.g., SOX-type controls, SoD) and engaging with auditors, vendors, and senior stakeholders.
• Relevant certifications preferred: Microsoft Certified: Identity and Access Administrator Associate (SC-300), CISSP, or an equivalent certification is an asset.

Compensation and Total Rewards

The base salary range for this role is $130,000 to $160,000 CAD plus a target Short-Term Incentive bonus of 25% and group benefit coverage. The hiring range reflects our targeted compensation framework for the role. The actual offer will be determined through a comprehensive evaluation of each candidate’s experience, capabilities, and potential impact, along with consideration of internal equity, team structure, and benchmark market data for similar positions. In addition to base salary, Kinross offers a comprehensive total rewards package designed to support employee well-being, performance, and long-term development.

Use of AI in Our Hiring Process

We use AI-enabled tools to help sort and review applications based on job-related criteria. All hiring decisions, including who moves forward in the process, are made by a human.

Existing Vacancy

This job posting is for an existing vacancy.