Start Date: ASAP
Dress Code: Business Casual A Great Place to Work

Founded in 1993, Kinross is a Canadian-based senior gold mining company with operations and projects in the United States, Brazil, Mauritania, Chile and Canada. Our focus on delivering value is based on our four core values of Putting People First, Outstanding Corporate Citizenship, High Performance Culture, and Rigorous Financial Discipline.
Mining responsibly is a priority for Kinross, and we foster a culture that makes responsible mining and operational success inseparable. Our values-based approach ensures that sustainability and our environmental, social and governance commitments are a core part of our strategy and plans for future growth. In line with our values, we also aim to build meaningful partnerships with all of our stakeholders, including communities, shareholders, employees, governments and suppliers.
The IAM Architect is accountable for the architecture, strategy, and design of the organization’s identity ecosystem, with primary ownership of the target-state architecture for Active Directory (AD), Microsoft Entra ID (formerly Azure AD), and the enterprise Identity Governance and Administration (IGA) platform. Sitting within the Enterprise Cyber team in IT, the Architect defines identity standards, reference architectures, and the multi-year IAM roadmap, provides technical leadership and mentoring to IAM engineers, and serves as the design authority for identity governance, hybrid identity, access management, Microsoft identity licensing, and identity data quality. The successful candidate combines deep technical credibility with architectural judgment: the ability to understand identity dependencies across infrastructure, cloud platforms, security controls, HR systems, and automations, and to evaluate the enterprise-wide impact of identity decisions. They will balance strategic architecture and governance with hands-on expertise in directory services, authentication protocols, identity governance, and automation, and will lead the cross-functional collaboration with HR, application owners, audit, and vendors needed to secure an increasingly autonomous, AI-driven enterprise.

Architecture Leadership, Security & Governance
Own the enterprise IAM architecture and multi-year roadmap, aligning identity capabilities with Enterprise Cyber strategy, business priorities, and regulatory requirements.
Define and maintain identity standards, design patterns, and reference architectures for directory services, authentication, authorization, identity governance, and privileged access.
Act as the design authority for identity solutions: lead architecture reviews, document architecture decisions, and govern exceptions through the established architecture review process.
Provide technical leadership and mentoring to IAM administrators, reviewing designs, code, and configurations and raising overall team capability.
Engage stakeholders and vendors (including Microsoft and Saviynt) on product direction, solution evaluations, escalations, and commercial and licensing discussions.
Support compliance, audit, and regulatory requirements through access certification, logging, SoD and policy enforcement, and own remediation of identity-related audit findings.
Partner with security operations, infrastructure, DevOps/platform teams, HR, and application owners to embed identity standards and architecture review into projects across the enterprise.

Directory Services, Hybrid Identity & Microsoft Licensing
Own Active Directory modernization, transformation, and future-state architecture, including forest, domain, trust, and OU design and the roadmap toward cloud-first identity in Microsoft Entra ID.
Define the architecture and security baselines for on-premises Active Directory (domains, forests, trusts, Group Policy, DNS, sites & services) and Microsoft Entra ID, and guide engineers in operating and optimizing them.




Design the hybrid identity architecture: Windows Hello for Business, FIDO2 security keys, passkeys), Privileged Identity Management (PIM), and Identity Protection.
Design and enforce a tiered administration model for AD and Entra ID (Tier 0/1/2, privileged access workstations, and protected admin accounts) to protect privileged identities.
Lead AD hygiene and modernization, including Group Policy rationalization, OU and delegation clean-up, remediation of legacy protocols and stale objects, and reduction of on-premises dependencies.
Own Microsoft 365 and Entra ID license management for identity services, including Microsoft 365 and Entra ID Governance entitlements.
Produce licensing reports and cost-optimization recommendations, and support renewals, true-ups, and compliance reviews with Procurement and Microsoft.

Identity Governance & Administration (IGA) and Identity Data Quality

Identity Governance & Administration (IGA) and Identity Data Quality
Own the architecture of the enterprise IGA platform (Saviynt), including connectors, workflows, and integrations with AD, Entra ID, the HR system of record, and downstream applications, and direct its continuous improvement.
Design the end-to-end identity lifecycle with HR as the authoritative source of truth, covering joiner/mover/leaver processes, provisioning and deprovisioning, and contractor and non-employee identities, orchestrated through Saviynt and Entra ID.
Design the access governance model: role-based access control (RBAC) and role models, entitlement catalogs, access certification and recertification campaigns, and segregation-of-duties (SoD) rules.
Define birthright access, access request and approval workflows, and policy-driven provisioning rules, and ensure they are implemented consistently across platforms.
Partner with audit, compliance, and application owners to design governance controls that meet regulatory and internal requirements, IT general controls, and ensure audit evidence is complete and repeatable.
Architect Microsoft Entra ID Governance capabilities (access reviews, entitlement management and access packages, lifecycle workflows, and PIM for roles and groups) and define how they complement Saviynt.
Design privileged access governance, including just-in-time elevation, approval and periodic review of privileged roles, and break-glass account controls.
Define identity data quality standards and attribute governance, including data ownership, authoritative sources, and HR-to-AD, Entra ID, and Saviynt attribute mapping.
Detect and remediate orphaned, duplicate, and stale accounts and inconsistent attributes (e.g., manager, department, location, employee type) through automated reconciliation.
Establish identity data quality reporting and KPIs, and partner with HR and data owners to correct issues at the source and prevent recurrence.

Define the governance model for machine and workload identities (service accounts, API keys, certificates, and secrets), with appropriate rotation and least-privilege controls.
Set the automation strategy and standards (PowerShell, Microsoft Graph API, Saviynt connectors and APIs, infrastructure-as-code) and oversee automation of identity lifecycle, licensing, and data quality workflows.
Define resilience requirements for identity systems, lead resilience and chaos testing (e.g., directory outage, MFA bypass scenarios), and lead root-cause analysis and post-incident improvements.

Required Technical Skills

Active Directory: Deep expertise in forest, domain, trust, and OU design,



Group Policy, DNS, replication, FSMO roles, tiered administration, AD security hardening, hygiene, and recovery.
Microsoft Entra ID: Conditional Access, MFA and passwordless authentication, PIM, Identity Protection, Entra ID Governance, app registrations, enterprise applications, dynamic groups, and group-based licensing; working knowledge of Microsoft 365 and Entra ID licensing (E3/E5, Entra ID P1/P2, Entra ID Governance).
Identity Governance & Administration: Proven experience architecting and integrating an enterprise IGA platform, ideally Saviynt (or SailPoint, One Identity, or equivalent), including connectors, lifecycle workflows, access certifications, RBAC, SoD controls, HR-driven provisioning, and identity attribute mapping and reconciliation; familiarity with Microsoft Entra ID Governance (access reviews, entitlement management, lifecycle workflows).
PowerShell (advanced), Microsoft Graph API, Saviynt connector and API integration, and infrastructure-as-code (e.g., Terraform), applied to lifecycle, licensing, and reconciliation automation.
Security & Architecture: Zero Trust, least privilege, privileged access management, and identity threat detection, together with architecture practices such as reference architectures, design standards, and architecture decision records.
Emerging / AI-era skills (preferred): AI agent and workload identity governance, human-AI orchestration, identity data modeling, and validation of AI-generated identity configurations.

Cross-functional influence & collaboration — works effectively across security, DevOps, HR, compliance, audit, and application teams; influences senior stakeholders and vendors and translates technical identity concepts for non-technical audiences.
Problem-solving & root-cause analysis — robust analytical and troubleshooting skills, especially under incident pressure.
Design Thinking — Applies a human-centered, creative approach to understand problems, generate innovative solutions, and design identity experiences that are both secure and easy to use.
Communication — clear written and verbal communication, including architecture documentation, roadmaps, and executive-level stakeholder engagement.
Leadership, ownership & accountability — mentors and develops administrators, sets quality standards, exercises autonomy, anticipates risk, and follows through on outcomes.
Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or equivalent experience.

- 10+ years of experience in identity and access management, including deep hands-on experience with Active Directory and Microsoft Entra ID in enterprise/hybrid environments and recent experience in an IAM architecture or technical lead role.
- Track record of owning identity architecture and roadmaps, leading complex hybrid identity or Active Directory modernization initiatives, and mentoring engineers.
- Experience managing Microsoft 365 and Entra ID licensing at enterprise scale and leading identity data quality or reconciliation programs.
- SOX-type controls, SoD) and engaging with auditors, vendors, and senior stakeholders.
- Microsoft Certified: Identity and Access Administrator Associate (SC-300), CISSP, or an equivalent certification is an asset.

The base salary range for this role is $130,000 to $160,000 CAD plus a target Short-Term Incentive bonus of 25% and group benefit coverage. The actual offer will be determined through a comprehensive evaluation of each candidate’s experience, capabilities, and potential impact, along with consideration of internal equity, team structure, and benchmark market data for similar positions. In addition to base salary, Kinross offers a comprehensive total rewards package designed to support employee well-being, performance, and long-term development.

We use AI-enabled tools to help sort and review applications based on job-related criteria.

📌 Urgent Architecte (F/H) (Toronto)
🏢 Kinross Gold
📍 Toronto