Identity Security Architect

Gibson Dunn is a leading global law firm, advising clients on significant transactions and disputes. Our exceptional teams craft and deploy creative legal strategies that are meticulously tailored to every matter, however complex or high-stakes. The firm’s work is distinguished by a unique combination of precision and vision. Based in Los Angeles or New York, the Identity Security Architect plays a critical role in the InfoSec team, leading the design, implementation, and assessment of identity security controls across the firm’s hybrid infrastructure. This position ensures compliance with Information Security and IS policies while aligning with industry best practices for identity security and zero trust. This role collaborates closely with the IT Architect, Cloud Administrators, and senior leadership on identity and zero trust operations. The Identity Security Architect will interface with technical teams, legal and compliance stakeholders, external auditors, and cloud service providers. Responsibilities include: • Define and own the firm’s enterprise identity security architecture and multi-year roadmap for workforce, privileged, service, and machine identities across hybrid and multi-cloud environments. • Establish identity security principles, reference architectures, standards, and reusable design patterns aligned with Zero Trust, least privilege, defense in depth, and regulatory requirements. • Lead the architecture and evolution of identity and access management capabilities, including identity governance and administration, access management, privileged access management, directory services, federation, single sign-on, multifactor authentication, passwordless authentication, and secrets management. • Architect identity solutions across Microsoft Entra ID, Active Directory, cloud platforms, SaaS applications, on-premises systems, and third-party services, ensuring consistent control enforcement and interoperability. • Design and govern identity lifecycle processes for joiners, movers, and leavers, including authoritative sources, provisioning, deprovisioning, role and entitlement models, access requests, approvals, certifications, and segregation-of-duties controls. • Develop the firm’s privileged access strategy, including administrative tiering, just-in-time and just-enough access, session controls, break-glass access, credential vaulting, and protection of high-value identities. • Define conditional access, authentication assurance, device trust, session management, and risk-based access policies that balance security, usability, resilience, and business requirements. • Provide architecture leadership for non-human identities, including service accounts, workload identities, managed identities, application credentials, API access, certificates, keys, and secrets throughout their lifecycle. • Lead identity threat modeling and architecture risk assessments for new technologies, applications, cloud services, mergers, and strategic initiatives; document risks and drive practical remediation plans. • Partner with Security Operations to define identity telemetry, detections, response playbooks, and recovery requirements for credential theft, privilege escalation, account compromise, and other identity-based attacks. • Embed identity security requirements into application development, DevSecOps, infrastructure-as-code, cloud onboarding, and technology procurement processes. • Chair or lead identity architecture and design reviews, evaluate exceptions, and ensure solutions conform to approved standards before implementation. • Assess identity security platforms and service providers, lead technical evaluations and proof-of-concept activities, and provide recommendations based on security, scalability, integratio