Cyber Systems Architect (Identity)

We create world-class content, which we distribute across our portfolio of film, television, and streaming, and bring to life through our theme parks and consumer experiences. We own and operate leading entertainment and news brands, including NBC, NBC News, MSNBC, CNBC, NBC Sports, Telemundo, NBC Local Stations, Bravo, USA Network, and Peacock, our premium ad-supported streaming service. We produce and distribute premier filmed entertainment and programming through Universal Filmed Entertainment Group and Universal Studio Group, and have world-renowned theme parks and attractions through Universal Destinations & Experiences. NBCUniversal is a subsidiary of Comcast Corporation.

Here you can be your authentic self. As a company uniquely positioned to educate, entertain and empower through our platforms, Comcast NBCUniversal stands for including everyone. Our Diversity, Equity and Inclusion (https://www.nbcuniversal.com/diversity-equity-inclusion) initiatives, coupled with our Corporate Social Responsibility (https://www.nbcuniversal.com/csr) work, is informed by our employees, audiences, park guests and the communities in which we live. We strive to foster a diverse, equitable and inclusive culture where our employees feel supported, embraced and heard. Together, we’ll continue to create and deliver content that reflects the current and ever-changing face of the world.

Join the NBCUniversal Operations and Technology (O&T) team and help drive strategy for the growing Identity and Access Management (IAM) service portfolio. The O&T IAM Architecture team is responsible for creating strategic solutions and setting the identity roadmap that supports the NBCUniversal enterprise and lines of business. This role is responsible for Identity Governance and Administration (IGA) service support and strategy. Youll be responsible for evaluating and developing on-prem and cloud-based IGA services with the goal of reducing cyber risk where our personas, devices, and applications consume identity. Successful candidates will couple a technical architectural mindset with a balanced solution approach, while applying knowledge, flexibility, and strong communication skills.

Responsibilities

Translate complex business requirements into IAM and IGA service functionality

Develop highly scalable identity service architectures serving enterprise, customer access, and external partner requirements

Produce technical solutions that meet NBCU business objectives and drive compliance with NBCU’s information security goals

Partner with technology and security teams across NBCU to provide technical expertise, design guidance, and drive best practices

Catalog risk embedded in legacy authentication implementations and help define a path to industry-aligned secure designs and services

Create and deliver effective presentations that inform NBCUniversal Senior Leadership teams to drive business relevant information security decisions

Mentoring/advising other team members

Lead product evaluations and new technology adoptions

Maintain strong vendor relationships that drive partnership with NBCU

Basic Requirements

Bachelors Degree or higher in Computer Science related field OR Non-Computer related Degree with equivalent work experience

5 years of experience in an identity architecture role

8 years of overall experience in IAM technical role(s) in a large enterprise that includes experience with modern IGA platforms (SailPoint IIQ, Saviynt, SailPoint IDN, EntraID), Windows Active Directory, Microsoft Azure AD, REST API programming

In-depth experience with defining secure and hardened information IAM solutions

Exceptional communication and interpersonal skills; including negotiation, facilitation, and consensus building skills; ability to influence, persuade, and manage polarities without direct control

High degree of flexibility and ability to work with employees at all levels of the organization with diverse backgrounds

Makes wise, data-informed decisions, finds and owns problems to closure

Ability to balance the long-term big picture and short-term implications of tactical decisions

Possesses an innovative technical mindset with a focus on architecture, strategy, and design

Strong desire to drive change

Significant experience with application connection design, consulting experience on IGA functions (i.e. user lifecycle management), access control policies, federation, certifications, access management, MFA, and role management

Significant experience designing initial infrastructure, on-boarding of applications, role-based access controls, policy and password management, certifications, workflows, work items and rules

Deep understanding of RBAC, identity policies, identity lifecycle automation and reporting, password policies, separation of duties, user provisioning, and approval workflows in Saviynt, EntraID, SailPoint IIQ, or SailPoint IDN

Ability to make source code level changes and has worked in a large multinational organization providing hands-on technical architecture services with J2EE development, Database, Java, Bean Shell/JavaScript, JSP/Servlets, SQL

Experience with REST Web services, SAML 2.0, JDKs, WS-Security, etc.

Experience working with modern and legacy enterprise authentication services (OpenID Connect (OIDC), OAuth2, SAML, WS Fed, Kerberos) and platforms (preferably Active Directory, Entra ID, AWS)

Experience with enterprise directory architecture, including significant knowledge of Active Directory and Entra ID

Desired Characteristics

Experience architecting and delivering large-scale Enterprise SailPoint service instances

Experience developing and delivering Zero Trust architectural designs

Experience with Venafi / Netwrix/ CyberArk

Experience with Google Cloud Platform (GCP) and Amazon Web Services (AWS)

Experience with large-scale ID Verification solutions for Enterprise and Consumer Identity solutions

A current cybersecurity professional certification (such as CISSP), a current IGA certification

Additional experience with other areas of IAM, such as Multi-factor Authentication (MFA), passwordless, Privileged Access Management (PAM), and Public Key Infrastructure (PKI)

Additional Requirements:

Fully Remote: This position has been designated as fully remote, meaning that the position is expected to contribute from a non-NBCUniversal worksite, most commonly an employee’s residence.

This position is eligible for company sponsored benefits, including medical, dental and vision insurance, 401(k), paid leave, tuition reimbursement, and a variety of other discounts and perks. Learn more about the benefits offered by NBCUniversal by visiting the Benefits page (https://www.nbcunicareers.com/benefits) of the Careers website. Salary range: $130,000 – $160,000 (bonus eligible)

We are accepting applications for this position on an ongoing basis.

As part of our selection process, external candidates may be required to attend an in-person interview with an NBCUniversal employee at one of our locations prior to a hiring decision.

NBCUniversals policy is to provide equal employment opportunities to all applicants and employees without regard to race, color, religion, creed, gender, gender identity or expression, age, national origin or ancestry, citizenship, disability, sexual orientation, marital status, pregnancy, veteran status, membership in the uniformed services, genetic information, or any other basis protected by applicable law. 

If you are a qualified individual with a disability or a disabled veteran, you have the right to request a reasonable accommodation if you are unable or limited in your ability to use or access nbcunicareers.com as a result of your disability. You can request reasonable accommodations by emailing AccessibilitySupport@nbcuni.com.

For LA County and City Residents Only:  NBCUniversal will consider for employment

qualified applicants with criminal histories, or arrest or conviction records, in a manner

consistent with relevant legal requirements, including the City of Los Angeles Fair Chance

Initiative For Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act, where applicable.