Founded in 1993, Kinross is a Canadian-based senior gold mining company with operations and projects in the United States, Brazil, Mauritania, Chile and Canada. Our focus on delivering value is based on our four core values of Putting People First, Outstanding Corporate Citizenship, High Performance Culture, and Rigorous Financial Discipline. Mining responsibly is a priority for Kinross, and we foster a culture that makes responsible mining and operational success inseparable. Our values-based approach ensures that sustainability and our environmental, social and governance commitments are a core part of our strategy and plans for future growth. In line with our values, we also aim to build meaningful partnerships with all of our stakeholders, including communities, shareholders, employees, governments and suppliers. Kinross maintains listings on the Toronto Stock Exchange (symbol: K) and the Current York Stock Exchange (symbol: KGC). Job Summary The IAM Architect is accountable for the architecture, strategy, and design of the organization’s identity ecosystem, with primary ownership of the target-state architecture for Active Directory (AD), Microsoft Entra ID (formerly Azure AD), and the enterprise Identity Governance and Administration (IGA) platform. Sitting within the Enterprise Cyber team in IT, the Architect defines identity standards, reference architectures, and the multi-year IAM roadmap, provides technical leadership and mentoring to IAM engineers, and serves as the design authority for identity governance, hybrid identity, access management, Microsoft identity licensing, and identity data quality. As automation and AI take on routine identity tasks, the Architect shapes the organization’s identity fabric, ensuring security, resilience, interoperability, and compliance across hybrid and multi-cloud environments. The successful candidate combines deep technical credibility with architectural judgment: the ability to understand identity dependencies across infrastructure, cloud platforms, security controls, HR systems, and automations, and to evaluate the enterprise-wide impact of identity decisions. They will balance strategic architecture and governance with hands‑on expertise in directory services, authentication protocols, identity governance, and automation, and will lead the cross‑functional collaboration with HR, application owners, audit, and vendors needed to secure an increasingly autonomous, AI‑driven enterprise. Key Responsibilities Architecture Leadership,



Security & Governance Own the enterprise IAM architecture and multi-year roadmap, aligning identity capabilities with Enterprise Cyber strategy, business priorities, and regulatory requirements. Define and maintain identity standards, design patterns, and reference architectures for directory services, authentication, authorization, identity governance, and privileged access. Act as the design authority for identity solutions: lead architecture reviews, document architecture decisions, and govern exceptions through the established architecture review process. Provide technical leadership and mentoring to IAM administrators, reviewing designs, code, and configurations and raising overall team capability. Engage stakeholders and vendors (including Microsoft and Saviynt) on product direction, solution evaluations, escalations, and commercial and licensing discussions. Define and enforce identity security standards, hardening baselines, and Zero Trust principles across AD, Entra ID, and Saviynt. Support compliance, audit, and regulatory requirements through access certification, logging, SoD and policy enforcement, and own remediation of identity-related audit findings. Partner with security operations, infrastructure, DevOps/platform teams, HR, and application owners to embed identity standards and architecture review into projects across the enterprise. Directory Services, Hybrid Identity & Microsoft Licensing Own Active Directory modernization, transformation, and future-state architecture, including forest, domain, trust, and OU design and the roadmap toward cloud-first identity in Microsoft Entra ID. Define the architecture and security baselines for on-premises Active Directory (domains, forests, trusts, Group Policy, DNS, sites & services) and Microsoft Entra ID, and guide engineers in operating and optimizing them. Design the hybrid identity architecture: Entra Connect / Cloud Sync topology, password hash sync / pass-through authentication, federation, and seamless SSO, including resilience and recovery design. Set the authentication strategy and Conditional Access framework, including MFA, passwordless authentication (e.G., Windows Hello for Business, FIDO2 security keys, passkeys), Privileged Identity Management (PIM),



and Identity Protection. Design and enforce a tiered administration model for AD and Entra ID (Tier 0/1/2, privileged access workstations, and protected admin accounts) to protect privileged identities. Lead AD hygiene and modernization, including Group Policy rationalization, OU and delegation clean-up, remediation of legacy protocols and stale objects, and reduction of on-premises dependencies. Own Microsoft 365 and Entra ID license management for identity services, including Microsoft 365 and Entra ID Governance entitlements. Design group-based licensing and automate license assignment and removal through the identity lifecycle, so licenses follow joiner/mover/leaver events, role, and employee type. Monitor license utilization, reclaim unused or misassigned licenses, and resolve assignment errors and conflicts. Produce licensing reports and cost-optimization recommendations, and support renewals, true-ups, and compliance reviews with Procurement and Microsoft. Identity Governance & Administration (IGA) and Identity Data Quality Identity Governance & Administration (IGA) and Identity Data Quality Own the architecture of the enterprise IGA platform (Saviynt), including connectors, workflows, and integrations with AD, Entra ID, the HR system of record, and downstream applications, and direct its continuous improvement. Design the end-to-end identity lifecycle with HR as the authoritative source of truth, covering joiner/mover/leaver processes, provisioning and deprovisioning, and contractor and non-employee identities, orchestrated through Saviynt and Entra ID. Design the access governance model: role-based access control (RBAC) and role models, entitlement catalogs, access certification and recertification campaigns, and segregation-of-duties (SoD) rules. Define birthright access, access request and approval workflows, and policy-driven provisioning rules, and ensure they are implemented consistently across platforms. Partner with audit, compliance, and application owners to design governance controls that meet regulatory and internal requirements, IT general controls, and ensure audit evidence is complete and repeatable. Architect Microsoft Entra ID Governance capabilities (access reviews, entitlement management and access packages, lifecycle workflows, and PIM for roles and groups) and define how they complement Saviynt. Design privileged access governance, including just-in-time elevation, approval and periodic review of privileged roles, and break-glass

📌 Iam Architect (Toronto)
🏢 Kinross Gold
📍 Toronto