Identity & Access Management (IAM) Architect Consultant - Wakefield, MA

Job Title: Identity & Access Management Architect Consultant Department: Client Technology Reports To: TBDLocation: Wakefield, MA (preferred) The Role:We are seeking a senior consultant to assess usability friction across a key customer's tools and workflows and develop practical recommendations for a more coherent, secure user experience. The consultant will connect stakeholder feedback to underlying process, data, architecture, and identity constraints across various disparate areas of the ecosystem.This engagement combines UX research and service design with technical architecture and identity and access management (IAM). The consultant will distinguish intentional design decisions from technical limitations and historical system evolution, validate root causes, and deliver a prioritized improvement roadmap for leadership and the engineering team. How You'll Be Successful:Identify why users encounter fragmented journeys, unclear status and next steps, inconsistent program workflows, and manual workarounds.Assess how login, access, identity lifecycle, entitlements, and system boundaries affect onboarding and task completion.Recommend improvements that reduce user effort and support demand while preserving appropriate security and program controls.Define actionable near-term changes and a phased target-state direction, with dependencies, estimated effort, and measurable outcomes. Core Responsibilities:UX Research & Workflow AssessmentFacilitate interviews and working sessions with external users, program stakeholders, support staff, security, IT, and engineering. Review available feedback, support records, training materials, and system documentation.Map representative journeys across systems and programs, including onboarding, access, submissions, approvals, status tracking, document collaboration, and data consumption, as applicable.Investigate navigation and system switching, workflow visibility, program inconsistencies, filtering and reporting limitations, dependence on institutional knowledge, and VMX document version and collaboration issues. Root cause analysis and solution designTrace observed friction to verified process rules, ownership gaps, integration limitations, data models, architecture, or identity controls. Document supporting evidence, assumptions, and unresolved questions.Develop future-state journey maps and selected wireframes or prototypes for priority workflows; validate recommendations with users and delivery teams.Evaluate standardization, integration, and configuration options against program requirements, security controls, technical feasibility, and operational impact. Identity strategy and architectureAssess authentication, authorization, federation, account recovery, and access patterns across the in-scope systems. Recommend a consistent user experience using SAML, OAuth 2.0, and OIDC where appropriate.Define a proportionate target-state IAM architecture and phased delivery roadmap using Zero Trust identity principles, least privilege, and clear separation of authentication from authorization.Review identity lifecycle and entitlement governance for internal and external users, including onboarding, changes, offboarding, provisioning, deprovisioning, and SCIM or connector opportunities.Assess privileged access, cloud roles, workload identities, service accounts, and API identities where they materially affect the in-scope architecture. Identify gaps and recommendations for vaulting, credential rotation, and monitoring as applicable.Identify relevant identity policy, auditability, privacy, and compliance requirements with security and compliance stakeholders; recommend controls and metrics without presuming a certification or compliance status. Collaboration and handoffPartner with existing engineering, security, IT, risk, compliance, and program teams to validate options, dependencies, ownership, and delivery estimates.Provide concise progress updates, facilitate prioritization decisions, and present an executive readout with a technical handoff that teams can use to plan implementation. Expected deliverablesCurrent-state assessment: system and identity architecture views, priority journey maps, and an evidence-based root cause register linking friction to constraints and user or operational impact.Future-state recommendations: improved workflows, selected wireframes or prototypes, and authentication, authorization, and identity lifecycle reference designs.Prioritized roadmap: quick wins and subsequent phases, indicative effort, dependencies, security considerations, recommended owners, and decision points.Implementation handoff: a backlog of actionable recommendations with acceptance criteria, plus an executive presentation and proposed success measures. Tentative engagement planWeeks 1–2: Confirm priority journeys and access to evidence; conduct discovery and map the current experience. Weeks 3–4: Validate root causes and develop UX and IAM options. Weeks 5–6: Test selected concepts, prioritize recommendations, and complete the roadmap and handoff. Weeks 7–8: conduct deeper validation or a narrowly scoped proof of concept agreed with the engagement sponsor, if necessary.The core engagement covers assessment, design, and planning. Production changes, platform migrations, and implementation of enterprise IGA or PAM programs would require separately agreed scope. Deliverable breadth will be confirmed at kickoff based on stakeholder availability and system access. Required qualificationsDemonstrated senior consulting experience assessing complex digital services that span multiple applications, user groups, and business programs.Strong capabilities in user research, journey mapping, service design, usability evaluation, root cause analysis, and translating findings into feasible delivery plans.Deep understanding of IAM architecture, federation protocols including SAML, OAuth 2.0, and OIDC, authorization models, identity lifecycle management, and least-privilege design.Practical experience with relevant IAM platforms such as Microsoft Entra ID or Okta, and familiarity with IGA and PAM solutions such as SailPoint and CyberArk. Ability to assess existing platforms and recommend appropriate options.Strong understanding of cloud IAM and hybrid architectures, with experience in AWS, Azure, or GCP and ability to evaluate integrations across the applicable environment.Working knowledge of modern authentication technologies including MFA, FIDO2, WebAuthn, and PKI, and ability to balance security controls with usability and accessibility.Ability to interpret application architecture, integrations, data flows, and operational processes in partnership with engineering teams.Excellent facilitation, written communication, and executive presentation skills; ability to work independently and deliver a clear handoff within a short engagement. Preferred experienceCustomer or partner identity management, including organizational relationships, delegated administration, and program-specific entitlements.Standards organizations, certification programs, member portals, regulated services, or comparable workflows involving submissions, approvals, and external participants.Document collaboration platforms, portal integrations, reporting and data usability, and accessible interaction design.Developing identity governance standards and translating audit or control requirements into practical architecture and delivery recommendations. Measures of successThe engagement succeeds when stakeholders agree on the principal causes of friction, priority recommendations have been validated for usability and feasibility, and leadership has a sequenced roadmap with clear ownership and dependencies. Proposed implementation measures should include task completion rates and time, support inquiries, onboarding and login success, manual touchpoints, and workflow status visibility. Baselines and targets will be established from available evidence during the engagement.