1162_Principal Identity Engineer/Architect (AD-Entra-Okta Migration)

LATCH LLC provides technical consulting services to the US Federal Government, focusing on high-quality solutions and innovative designs. The Principal Identity Engineer/Architect will lead the migration of on-premises Active Directory services to Entra ID and Okta, overseeing the architecture, planning, and execution of this enterprise identity modernization effort.

Responsibilities:

• Lead the architecture and design of the enterprise Active Directory to Okta and Entra ID migration strategy, including governance, synchronization, coexistence, and long-term identity modernization patterns
• Develop the migration roadmap, technical design documentation, data models, attribute strategies, and phased implementation plan
• Evaluate and define authentication and authorization patterns using Entra ID, Okta, and hybrid identity services
• Perform hands-on engineering tasks including directory synchronization configuration (Entra Connect / Cloud Sync), domain consolidation, forest remediation, schema extension validation, conditional access design, and authentication flow design
• Engineer and implement secure identity federation, SSO, and application migration to Entra ID and Okta
• Execute directory clean-up, identity rationalization, and environment normalization as part of modernization efforts
• Identify migration risks, service dependencies, integration challenges, legacy system constraints, and remediation strategies
• Develop and execute detailed test plans, pilot programs, coexistence validation, rollback plans, and production cutover procedures
• Conduct performance, reliability, and security validation for all directory and identity workloads being migrated
• Provide technical leadership to engineers, analysts, and cross-functional teams involved in the migration
• Serve as a senior advisor to program leadership, communicating architectural decisions, constraints, risks, and tradeoffs with clarity
• Coordinate with security, networking, application owners, and enterprise architecture teams to ensure alignment and interoperability
• Produce high-quality engineering documentation, architecture diagrams, standards, migration runbooks, and operational SOPs
• Establish and enforce directory and identity governance best practices aligned to Zero Trust and federal security requirements

Requirements:

• Extensive hands-on experience designing and migrating Active Directory environments, including multi-domain/forest consolidation, remediation, and modernization
• Proven experience planning and executing large-scale migrations to Entra ID (Azure AD), including Cloud Sync, Entra Connect, attribute flows, UPN/identity normalization, and hybrid identity patterns
• Strong expertise integrating Okta with Active Directory and Entra ID for authentication, provisioning, federation, and lifecycle management
• Deep understanding of identity protocols and technologies including OIDC, OAuth 2.0, SAML, Kerberos, NTLM, LDAP, LDAPS, and certificate-based authentication
• Demonstrated ability to define identity architecture, evaluate tradeoffs, and make high-stakes technical decisions
• Strong hands-on engineering skills with PowerShell, directory utilities, synchronization tools, replication troubleshooting, and identity analytics
• Experience designing Conditional Access, MFA, secure authentication flows, segmentation, and Zero Trust identity patterns
• Ability to lead technical efforts, guide engineers, and manage deliverables in a complex, multi-team environment
• Strong communication skills with an ability to translate complex identity architecture into clear guidance for technical and non-technical stakeholders
• Strong analytical and troubleshooting skills with an obsessive attention to detail and accuracy
• 15+ years of Systems Engineering experience
• 10+ years of experience supporting enterprise identity and directory services
• 5+ years hands-on experience designing and executing Active Directory modernization and migration efforts
• 5+ years of experience supporting or integrating with Entra ID (Azure AD)
• Proven track record delivering large-scale identity transformations in complex enterprise environments
• Experience with large-scale identity modernization efforts within federal agencies or regulated industries
• Experience modernizing legacy authentication or IAM platforms during AD/Entra migrations
• Familiarity with identity governance, privileged access management, or Zero Trust policy enforcement
• Experience with Infrastructure as Code (Terraform, Bicep) for Entra ID and identity configuration deployment
• Experience integrating identity systems with cloud workloads, Kubernetes, API gateways, and enterprise SaaS platforms
• Certification(s) such as: Microsoft Identity and Access Administrator (SC-300), Microsoft Azure Solutions Architect (AZ-305), Okta Certified Professional or Okta Certified Consultant, CISSP or equivalent