Senior Identity Analyst/Architect

Senior Identity Analyst/Architect

Due Date: November 27, 2026

Term: December 1, 2026, to May 31, 2027. 6 Months initial engagement with potential for a 6-month extension.

Start Date: December 1, 2026

Location: Services would be carried out as a combination of on site, remote, or hybrid.

DELIVERABLES:

Looking for Senior Identity Analyst/Architect resource/service for a 6-month term with the option to extend for an additional 6 months. Services would be carried out as a combination of on site, remote, or hybrid. Open to resources across Canada but resources would need to be available for the bulk of an 8:00 to 5:00 workday in Saskatchewan.

Client would be open to less than full time arrangements. Include the number of hours per week that the proposed resource would be available to work on initiatives.

The resource will work with Cyber Security and Identity teams to advance several identity modernization and security initiatives. Preference will be given to resources who can work collaboratively with internal technical teams and provide practical, hands-on support through architecture, configuration, implementation planning, documentation and knowledge transfer.

Requirements:

The following describes the required skills and experience:

Microsoft Entra and Identity Security Expertise

Advanced knowledge of Microsoft Entra ID, including:

Conditional Access

Authentication Methods

Microsoft Entra ID Protection

Privileged Identity Management

External Identities and B2B collaboration

Hybrid identity integration

Microsoft Graph and identity automation

Demonstrated experience designing and implementing identity security controls in a large, complex and hybrid enterprise environment.

Strong understanding of Zero Trust principles and their practical application to identity, authentication, device trust and privileged access.

Key Roles and Responsibilities:

Passkey and Phishing-Resistant Authentication

Develop and support a phased implementation of passkeys and phishing-resistant authentication, including:

FIDO2 security keys or device-bound passkeys for privileged and administrative accounts.

Windows Hello for Business for employees.

A future approach for B2B guests when Microsoft provides suitable passkey support for external identities.

Assist with authentication method policies, registration controls, Conditional Access integration, recovery processes and deployment sequencing.

Identify technical, operational and user-experience dependencies, including the treatment of shared devices, unmanaged devices, break-glass accounts and users requiring exceptions.

Produce implementation guidance and an adoption roadmap for moving toward phishing-resistant authentication.

Modernization of On-Premises Privileged Access

Assess current approach to privileged access for on-premises Active Directory, servers and related infrastructure.

Identify and evaluate potential solutions using Microsoft Entra, Active Directory or a complementary privileged access platform.

Consider requirements for:

Entra-to-Active Directory user and group provisioning or writeback.

Privileged account separation.

Just-in-time and time-bound access.

Approval and access-request workflows.

Credential and secret management.

Administrative tiering and isolation.

Logging, monitoring and access review.

Emergency and break-glass access.

Develop a recommended target architecture and practical implementation roadmap that recognizes client's hybrid identity environment and existing operational dependencies.

SMS Authentication Transition

Assess current use of SMS for multifactor authentication, account recovery and related identity processes.

Develop a transition plan to reduce and ultimately remove reliance on SMS where it is no longer appropriate or supported.

Evaluate Microsoft-native alternatives and, where required, potential third-party authentication or verification solutions.

Identify affected user populations, applications, dependencies, exceptions and business processes.

Recommend a migration approach that addresses security risk, user adoption, accessibility, account recovery and operational support.

Architecture, Documentation and Governance

Produce clear identity architecture and implementation documentation, including:

Current-state assessments.

Target-state designs.

Architecture diagrams.

Configuration standards.

Decision records.

Risk and dependency assessments.

Implementation plans and roadmaps.

Operational procedures and support documentation.

Ensure recommendations align with security architecture, identity governance, privacy, resilience and risk-management requirements.

Present technical findings and recommendations in language suitable for technical teams, governance bodies and senior leadership.

Necessary Knowledge, Skills, and Experience:

Demonstrated hands-on experience delivering comparable Microsoft identity modernization initiatives.

Ability to move between strategic architecture work and detailed technical configuration or implementation support.

Strong written and verbal communication skills.

Ability to explain complex identity and security concepts to both technical and non-technical stakeholders.

Ability to work effectively with Cyber Security, Identity, Infrastructure, End User Computing, Architecture and application teams.

Provide practical knowledge transfer to employees throughout the engagement rather than relying only on end-of-engagement documentation.

References and Certifications:

Provide examples of comparable identity and authentication engagements completed by the proposed resource.

Provide client references, preferably from large organizations operating hybrid Microsoft identity environments.

Provide details of relevant certifications, which may include:

Microsoft Certified: Cybersecurity Architect Expert

Microsoft Certified: Identity and Access Administrator Associate

CISSP

CCSP

GIAC certifications

Other relevant Microsoft identity or security credentials

If interested in this position, please send your resume to [email protected]

Resume should include:

Examples of comparable identity and authentication engagements

Client references, preferably from large organizations operating hybrid Microsoft identity environments.

Details of relevant certifications