Tanweer Ahmad

– Designed and implemented ForgeRock Access Manager (AM) and Directory Services (DS) solution. – Architected and configured FIDO2-based passwordless authentication for web and mobile channels, leveraging WebAuthn and device biometrics. – Deployed AM and DS on high-availability architecture with secure LDAPS, JWT signing keys, and custom certificate management. – Tuned DS backend performance, replication strategy, and log rotation for production-grade stability. – Provided recommendations for future FIDO2 expansion and IAM roadmap alignment with Open Banking security models.

– Led the design and integration of SailPoint IdentityIQ (IIQ) and Saviynt IG to modernize AMEX's enterprise identity governance and compliance landscape. – Designed custom provisioning workflows, business role models, and approval chains within SailPoint IIQ to align with AMEX compliance policies. – Developed and optimized lifecycle event rules, role mining, and policy violation remediation workflows. – Configured connectors for Active Directory, HR systems, and downstream applications to automate user onboarding/offboarding and access certifications. – Architected Saviynt connector integrations for key AMEX enterprise systems, focusing on cloud application governance (Azure, AWS, ServiceNow)

– Led the end-to-end discovery process with business and technical stakeholders to assess the current OKTA ecosystem, authentication flows, federation configurations, and application portfolios. – Developed a detailed migration roadmap covering identity federation, user lifecycle operations and Saviynt (IGA) with authentication journeys, and risk-based access flows. – Designed an enterprise strategy to migrate multiple payment platforms from legacy Ping Access Management to a modern ForgeRock cloud-based SSO solution. – Created architecture patterns for authentication, federation, policy enforcement, and session management aligned with financial-industry security standards. – Built a phased migration plan for transitioning SAML and OAuth2/OIDC applications from OKTA to ForgeRock Identity Cloud. – Designed user provisioning and de-provisioning workflows to align with the new ForgeRock IAM model. – Architected an enterprise authorization migration model, including RBAC/ABAC alignment, policy restructuring, entitlement mapping, and attribute governance. – Documented authorization patterns for service-to-service APIs, user-facing apps, and payment system components. – Defined the PAM operating model for all IAM-related SAccounts using CyberArk Vault. – Ensured AIM (Application Identity Manager) integration requirements for IAM services, connectors, and automation components. – Documented operational processes for credential rotation, vault onboarding, and privileged access workflows. – Architected a complete future-state IAM landscape based on ForgeRock Access Management (AM), Identity Manager (IDM), and Directory Services (DS). – Defined migration patterns to transition authentication, user management, and federation services from OKTA IAM to the ForgeRock stack. – Assessed and migrated 27 OAuth 2.0 / OIDC applications originally onboarded to OKTA into the ForgeRock IAM platform. – Re-engineered client registrations, scopes, token policies, redirect URIs, and risk controls. – Architected IIQ → ForgeRock integration to migrate user identities from CA Directory IDP to ForgeRock DS. – Designed LDAP schema mapping, authoritative source alignment, provisioning flows, and lifecycle event handling. – Designed production-grade HA and multi-node clusters for ForgeRock AM, IDM, IG, and DS to support both CIAM-scale identities and corporate IDP needs. – Build - Architecture of HA

– Architected SSO flows across SailPoint IIQ, ServiceNow, and enterprise SSPR modules. – Architected and deployed IdentityNow for self-service password reset, AD provisioning, identity lifecycle, and access certification. – Integrated Workday as the authoritative source for IdentityNow.

– Integration of IIQ 6.1 in Windows 2008 R2 Environment with Oracle Databases 11gR2 – LCM and Governance for Onboarding Process – Worked on GAP Analysis for Onboarding process for throughout the globe for Onboarding – Role Mining through Workflow process – Integration of cloud-based Ticket systems (SERVICE NOW) – Development of workflow in IIQ for service now – Two steps of Approval process through Service Now Admin as well as Target system Approver – Integration of several different Application based on LDAP – Audit and reporting for IAM Application integration

– Design and architect enterprise-grade Identity and Access Management (IAM) solutions using PingOne and ForgeRock Identity Cloud (AIC) to deliver secure authentication, authorization, and identity governance capabilities.

– Developed and implement API-driven onboarding frameworks to automate application registration, entitlement mapping, and role-based access provisioning across on-premises and cloud ecosystems. – Build and customize the IAM Access Request process within ForgeRock AIC, including form design, approval workflows, and policy enforcement aligned with business and compliance requirements. – Configure and optimize Multi-Factor Authentication (MFA), adaptive authentication, and contextual access policies using PingOne and ForgeRock Access Manager modules. – Lead the migration of legacy authorization components to modern, standards-based architectures (OIDC, OAuth2, SAML) ensuring interoperability across hybrid identity platforms. – Define and govern identity data models, token policies, and attribute release frameworks to maintain consistency, scalability, and data security. – Develop and enhance custom APIs, connectors, and workflows for automated provisioning, de-provisioning, and access certification across IAM ecosystems. – Perform architecture reviews, tuning, and compliance validation to ensure IAM solutions meet enterprise security, audit, and regulatory standards. – Designed and led end-to-end integration of ForgeRock Identity Cloud, Ping Identity, and SailPoint IIQ components to support Humana's enterprise Identity Governance using Saviynt (IGA) and Access Management strategy. – Defined integration patterns, data flow, and API design for seamless provisioning, authentication, and entitlement management between Humana internal systems and external SaaS platforms. – Collaborated with Humana Sr. IAM leadership to establish architectural standards, approval workflows, and compliance controls aligned with healthcare and HIPAA requirements. – Managed onsite-offshore delivery model, coordinating daily stand-ups, design reviews, and sprint planning with Accenture offshore teams. – Provided technical governance, ensuring adherence to Humana's architectural blueprints, coding standards, and CI/CD automation practices. – Reviewed design artifacts, API specifications, and test results to ensure performance, scalability, and security alignment. – Architected and validated integrations across Apigee API Gateway, ForgeRock AM, and PingOne OIDC to enable secure API-based access control and token-based SSO. – Defined interface contracts for identity data synchronization between HR systems, Active Directory, and Ping Directory. – Led proof-of-concept (POC) for API-based group provisioning and entitlement request automation through workflow-driven orchestration in ForgeRock AIC. – Designed custom workflows and approval processes for Role/Group request automation with dynamic attribute mapping and auto-approval logic for privileged roles. – Enhanced governance controls in SailPoint (IIQ) / Saviynt (IGA) to ensure accurate account correlation, SoD enforcement, and certification readiness. – Acted as the primary liaison between Humana's internal IAM leadership, security governance teams, and Accenture's offshore engineering units. – Conducted architecture review sessions, solution walkthroughs, and training for Humana IAM administrators and developers. – Provided status reporting, risk assessments, and design documentation for executive and compliance review boards.

– Designed and implemented end-to-end ForgeRock Identity Cloud (AIC/IDC) solution for Telus enterprise identity modernization initiative. – Defined realm structure, authentication trees, and access policies to support multiple Telus business applications and customer identity types (B2E, B2C). – Integrated ForgeRock IDC with Ping Directory and Telus corporate LDAP for centralized identity data management and replication. – Built complex authentication trees leveraging LDAP, Active Directory, and social/OIDC providers for multi-factor authentication (MFA) and risk-based access. – Implemented fine-grained access policies using AM policy sets, scripted conditions, and dynamic scopes for Telus digital services. – Developed custom Groovy scripts and IDM connectors to automate account provisioning and entitlement assignments across multiple systems. – Created REST-based integrations between ForgeRock IDM, Access Manager, and external APIs (e.g., Telus provisioning APIs and HR systems). – Worked closely with Telus security, IAM, and DevOps teams to align the ForgeRock architecture with enterprise security policies and standards. – Participated in architecture reviews, sprint planning, and release cycles, delivering high-quality IAM integration components on schedule.

– Designed a unified IAM architecture spanning US, Mexico, and Canada, integrating multiple region-specific IAM systems into a single enterprise model. – Developed cross-region identity consolidation patterns while maintaining compliance with local security, privacy, and HR requirements. – Architected and executed the merger of three independent identity systems into a centralized IAM platform for employees, partners, contractors, and third-party vendors. – Defined identity correlation logic, attribute normalization, and reconciliation across multiple authoritative sources. – Integrated SailPoint IIQ with Workday and additional HR systems to support identity lifecycle for three distinct organizational tenants in the same enterprise. – Engineered ingestion pipelines for contractors, employees, and seasonal staff with custom business logic and provisioning workflows. – Led the migration and architecture redesign from older IIQ versions to SailPoint IIQ 8.0, including: – New server topology – Clustered application servers – Updated connectors – New workflow framework and governance models – Integrated SIG to streamline application onboarding, entitlement mapping, and governance workflows. – Established common onboarding templates, certification rules, and policy models. – Architected CyberArk integrations with Active Directory, enterprise applications, and infrastructure systems. – Automated onboarding for Windows, Linux, SQL, Azure AD, domain admin, service accounts, and privileged service accounts. – Replaced hardcoded application passwords with CyberArk AIM for secure, policy-driven credential injection. – Ensured alignment with SEC_OPS policies and automated rotation standards. – Architected integration patterns for OKTA federation with enterprise and partner applications. – Managed SAML metadata exchange, OAuth/OIDC client design, scopes, tokens, and session policies. – Designed and implemented advanced privileged access scenarios, including: – Windows RDP with local admin elevation – Temporary elevated server access – Jump host authentication (on-prem + cloud) – Simultaneous multi-server privileged sessions – SQL Server integrated authentication workflows – Designed fully automated onboarding for multiple account types using: – CyberArk Account Discovery – Manual workflows – PowerShell + CyberArk REST API automation – Onboarded thousands of accounts across Windows, Linux, SQL, Azure AD, and legacy systems.

– Designed and implemented multi-instance ForgeRock AM/IDM/DS architecture on EC2 to support high availability, horizontal scaling, and cross-region resiliency. – Integrated Workday with ForgeRock IDM to ingest, normalize, and provision identity data for contractors, employees, and multi-tenant organizational structures – Architected a unified IAM platform to consolidate identities across three regions while preserving local policies, HR processes, and compliance controls. – Designed and delivered an enterprise-level ForgeRock upgrade involving: – New AM/IDM/IG/DS architecture – Migration of configurations and auth trees – DS backend and schema transitions – EC2-based HA cluster rollout – Integrated OKTA as the primary identity provider for corporate and Active Directory-centric applications. – Designed SSO flows leveraging SAML and OAuth2/OIDC for both on-prem and cloud workloads.

– Designed and integrated ForgeRock IDM, OpenAM, OpenDJ, and OpenIG across multiple EC2 instances. – Implemented application integrations using LDAP, SAML federation, biometric authentication, and MFA workflows – Architected a unified IAM platform supporting Toyota's customer portal and end-user identity lifecycle across North America – Designed and deployed re-registration flows using modern MFA mechanisms such as Google Authenticator, Facebook login, and Apple ID.

– Architected SSO flows across SailPoint IIQ, ServiceNow, and enterprise SSPR modules. – Architected and deployed IdentityNow for self-service password reset, AD provisioning, identity lifecycle, and access certification. – Integrated Workday as the authoritative source for IdentityNow. – Integrated IdentityNow with ServiceNow to automate ticketing – Implemented AD entitlement governance using IdentityNow's role model. – Architected OKTA federation patterns for over 12 applications using SAML and OAuth/OIDC

– Acquired information of existing SAAS Platform Applications – Planned Migration Process of SAAS application into central IAM Solutions. – Architect and design backend layer for internal, external as well as partners application to manage through SAML – Helped customer to make decision in selection of IAM Products based on requirement. – Build Agile process for Migration process into central IAM solution. – Architect internal IAM and cloud-based application and identity systems – Started working on IAM Products (OpenIG, OpenAM, OpenDJ and OpenIDM) to integrate legacy IAM systems and building fine grained authorization system based on RBAC and ABAC – Integration of IAM with Privileged Identity Management (PIM) – Uplift SAAS Platform applications and IAM Products into AZURE from in-premises – Architect for integration of internal application and manage services accounts with PIM (CyberArk) – Integration of more than 1800 servers through PIM and Password using CyberArk VAULT – Architecture of CPM, PVWA, EPV to manage and central policy for password and access control systems for PAM Account – Integrate 9.1 and 10.0 PVWA of CyberArk module, Onboarding of accounts of Windows, Linux, Oracle

– Provide end to End Solution using ForgeRock products (OpenAM, OpenDJ, OpenIDM) – Design & Development of IAM Implementations through AGILE methodologies – Designed 6 clustered HA datacenter throughout GLOBE for 30 million identities for more than 270 customers for On Boarding – Designed LDAP (OpenDJ) replicated environment for LDAP, SAML and OAuth implementations – Worked on Access Control Instruction for custom schema to support attributed based access – Deployed REST end points to support API CRUD Operation directly through OpenAM and OpenIDM – Develop Different set of architectures I,e Process Diagram, Sequence diagram. – Implemented couple of use cases with OAUTH 2.0 (Google+ / Facebook / LinkedIn Provider) and SAML 2.0 – Developed custom Authentication for Multiple IDP (identity provider) through IDP proxy for SAML V2 – Implemented two factor authentications through Google Auth / Token Based and QA based – Implemented OAuth 2.0 with (Authorization code / Refresh Token / Password grant) Types based authentication – Worked on OpenIDM with out of the box connectors to get access through REST End points – Integrate Splunk for Logging of (OpenDJ / OpenAM)

– SailPoint Identity Management Implementation for UPSTREAM and DOWNSTREAM Employee Management systems of World No one company in OIL and GAS – Involved in the development of Solution Design in CA IAM solutions

– Implementation of Oracle Identity Manager 11g R1, OUD, OID – Design & Architect the Requirement for Oracle Identity Manager with WebLogic 10.3.5 – Work with Business Analyst of Internal Team of Ameren IT Team – As a Sub contractor of E&Y work with Project Director – Design Phase - 1 Project of OIM-PeopleSoft 8.1 Integration – Architect 60000 users-based Identity Manager Implementations

– Multiple projects on these Technologies – Sun Identity Management – OpenSSO – Oracle IDM – ADF, Java, Struts, Oracle, Active Directory, exchange, people-soft, XML etc.