Configuration Management Architect - Remote, Remote

Xtensys is a rapidly growing managed service provider delivering innovative technology solutions to health systems, beginning in New York and expanding nationwide. Owned by two industry leaders with a strong focus on advancing rural and community healthcare, Xtensys is executing several major initiatives and scaling quickly. With a team of more than 500 professionals, we are building a people-centered culture rooted in collaboration, innovation, and strategic thinking.

You'll lead projects, define success, and manage complexities with total support.

• We encourage risk-taking and continuous improvement.
• Your Mission: The IAM Architect is a senior technical lead responsible for designing, documenting, and driving the maturation of identity and access management capabilities across the Xtensys environment and its customers. The IAM Architect is expected to proactively identify process gaps, access anomalies, governance risks, and operational inefficiencies without waiting to be directed. When something is wrong or could be improved, the expectation is that you investigate it, document your findings, and bring a recommendation, not just an observation. In the near term, the Architect will optimize existing tooling, including ManageEngine ADManager Plus, to reduce manual lifecycle work and improve governance controls while the organization evaluates a next-generation IGA platform (SailPoint IdentityNow, pending budget approval). In the longer term, the Architect will lead the design and phased implementation of that platform, including Epic EMR provisioning, enterprise RBAC, and access certification programs.

Continuously monitor identity systems, access patterns, lifecycle workflows, and audit logs for anomalies, policy violations, and process gaps without waiting for issues to be escalated.

• Independently investigate anomalies, document root cause findings, and implement or recommend corrective actions with minimal direction.
• Establish and maintain proactive monitoring practices including stale account detection, orphaned access identification, offboarding compliance tracking, and privilege creep analysis.
• Maintain a standing risk and improvement register for the IAM program, self-updating it as new findings are identified and tracking items through resolution.

Assess, document, and baseline all primary IAM workflows including Joiner, Mover, Leaver, Leave of Absence, and Reactivation processes across all Xtensys-managed domains.

• Identify and document manual process steps, tooling gaps, compliance exposure, and quality control risks in existing workflows.
• Maintain living documentation of the IAM environment including architecture diagrams, process flows, and system integration maps.

Develop and maintain a multi-horizon IAM program roadmap that addresses current state gaps, defines measurable future state outcomes, and accounts for budget contingencies and platform decisions.
• Evaluate emerging IAM platforms and technologies against organizational requirements and present structured vendor recommendations to IAM leadership.

Design, implement, and optimize Joiner, Mover, and Leaver workflows across on-premises Active Directory, Microsoft Entra ID, and integrated SaaS platforms.

• Design and implement Workday-to-IGA Platform integration for lifecycle event triggering, attribute mapping, and manager synchronization.
• Define and enforce offboarding standards including cross-domain account disablement, Epic access revocation, and privileged account closure within defined SLAs.

IGA Platform Implementation (SailPoint IdentityNow):

• Lead the design and phased implementation of SailPoint IdentityNow pending budget approval, including connector configuration, lifecycle workflow build, and role model design.
• Manage Epic EMP and SER integration within the IGA platform, coordinating with Epic Security and clinical informatics teams.
• Design and implement access certification campaigns, attestation workflows, and governance reporting within the IGA platform.

• Identity Governance and Access Control:

• Design and implement enterprise RBAC models across Active Directory, Entra ID, and clinical systems, with particular attention to Epic security role correlation.
• Conduct and support periodic access reviews, recertifications, and audit evidence collection across all managed identity systems.
• Develop and enforce IAM policies covering account standards, naming conventions, attribute requirements, and lifecycle SLAs.

• Technical Operations and Escalation:

• Serve as the senior technical escalation point for identity-related service tickets, provisioning failures, and access disputes.
• Monitor IAM infrastructure for performance, availability, and security anomalies; 8+ years of hands-on IAM experience with a combination of design, implementation, and operational ownership of enterprise identity systems.
• Experience with Workday-to-Active Directory integration including HR-driven provisioning, attribute mapping, and lifecycle synchronization.
• SailPoint IdentityNow implementation experience including connector development, lifecycle workflow configuration, role model design, and access certification campaigns.
• Familiarity with Epic EMR identity and access workflows, including EMP record management, SER provider records, security template design, and provisioning integration with an IGA platform.
• SailPoint Certified IdentityNow Engineer or equivalent IGA platform certification preferred.
• Microsoft Identity and Access Administrator (SC-300) or equivalent Entra ID certification preferred.

Deep expertise with Microsoft Active Directory and Microsoft Entra ID (Azure AD) including hybrid identity, Conditional Access, and delegated administration.

• Strong PowerShell scripting capability for lifecycle automation, audit log analysis, group membership management, and reporting.
• Occasional travel (5% or less) may be required for team meetings and collaboration.

LI-Remote