IAM Architect in Toronto

Founded in 1993, Kinross is a Canadian-based senior gold mining company with operations and projects in the United States, Brazil, Mauritania, Chile and Canada. Our focus on delivering value is based on our four core values of Putting People First, Outstanding Corporate Citizenship, High Performance Culture, and Rigorous Financial Discipline. Mining responsibly is a priority for Kinross, and we foster a culture that makes responsible mining and operational success inseparable. Our values-based approach ensures that sustainability and our environmental, social and governance commitments are a core part of our strategy and plans for future growth. In line with our values, we also aim to build meaningful partnerships with all of our stakeholders, including communities, shareholders, employees, governments and suppliers.

The IAM Architect is accountable for the architecture, strategy, and design of the organization’s identity ecosystem, with primary ownership of the target-state architecture for Active Directory (AD), Microsoft Entra ID (formerly Azure AD), and the enterprise Identity Governance and Administration (IGA) platform. Sitting within the Enterprise Cyber team in IT, the Architect defines identity standards, reference architectures, and the multi-year IAM roadmap, provides technical leadership and mentoring to IAM engineers, and serves as the design authority for identity governance, hybrid identity, access management, Microsoft identity licensing, and identity data quality.

Key Responsibilities:

• Own the enterprise IAM architecture and multi-year roadmap, aligning identity capabilities with Enterprise Cyber strategy, business priorities, and regulatory requirements.
• Define and maintain identity standards, design patterns, and reference architectures for directory services, authentication, authorization, identity governance, and privileged access.
• Act as the design authority for identity solutions: lead architecture reviews, document architecture decisions, and govern exceptions through the established architecture review process.
• Provide technical leadership and mentoring to IAM administrators, reviewing designs, code, and configurations and raising overall team capability.
• Engage stakeholders and vendors (including Microsoft and Saviynt) on product direction, solution evaluations, escalations, and commercial and licensing discussions.
• Define and enforce identity security standards, hardening baselines, and Zero Trust principles across AD, Entra ID, and Saviynt.
• Support compliance, audit, and regulatory requirements through access certification, logging, SoD and policy enforcement, and own remediation of identity-related audit findings.
• Partner with security operations, infrastructure, DevOps/platform teams, HR, and application owners to embed identity standards and architecture review into projects across the enterprise.

Required Technical Skills:

• Deep expertise in Active Directory, including forest, domain, trust, and OU design, Group Policy, DNS, replication, FSMO roles, tiered administration, AD security hardening, hygiene, and recovery.
• Proven experience architecting and integrating an enterprise IGA platform, ideally Saviynt (or equivalent).
• Strong working knowledge of SAML, OIDC, OAuth 2.0, SCIM, Kerberos, and LDAP.
• PowerShell (advanced), Microsoft Graph API, Saviynt connector and API integration, and infrastructure-as-code.
• Zero Trust, least privilege, privileged access management, and identity threat detection.

Required Soft Skills:

• Strategic judgment — ability to make sound decisions in high-stakes, ambiguous, and non-routine identity scenarios.
• Cross-functional influence & collaboration — works effectively across security, DevOps, HR, compliance, audit, and application teams.
• Problem-solving & root-cause analysis — strong analytical and troubleshooting skills.
• Communication — clear written and verbal communication.
• Adaptability & continuous learning — thrives in a rapidly changing environment.

Qualifications and Skills:

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or equivalent experience.
• 10+ years of experience in identity and access management.
• Demonstrated experience designing and implementing an enterprise IGA platform.
• Experience managing Microsoft 365 and Entra ID licensing at enterprise scale.
• Relevant certifications preferred: Microsoft Certified: Identity and Access Administrator Associate (SC-300), CISSP, or an equivalent certification.

Compensation and Total Rewards:

The base salary range for this role is $130,000 to $160,000 CAD plus a target Short-Term Incentive bonus of 25% and group benefit coverage.