The role is responsible for implementing, configuring, integrating, and maintaining IBM z/OS Multi-Factor Authentication (zMFA) capabilities within a RACF-protected mainframe environment. The engineer will work on integrating zMFA with Microsoft Entra ID MFA services to strengthen authentication for interactive mainframe access, while ensuring secure configuration, operational readiness, and effective user enrollment and recovery processes.
Key Responsibilities
- Team Roles and Responsibilities: Identify and define the roles, responsibilities, and dependencies of teams involved in zMFA implementation, identity integration, mainframe security, and ongoing operations.
- Microsoft Entra ID Assessment: Understand the hosting architecture, configuration, and MFA capabilities of Microsoft Entra ID to support zMFA integration.
- MFA Push Notification Analysis: Identify and validate the appropriate communication channels and authentication methods required to support MFA push notifications.
- IBM zMFA Maintenance: Apply IBM-recommended maintenance, fixes, and updates to zMFA components in accordance with established change management procedures.
- Runtime Configuration: Configure and validate zMFA runtime parameters to meet security, authentication, and operational requirements.
- zMFA Installation and Base Configuration: Install and configure zMFA components on in-scope z/OS systems protected by RACF.
- Started Tasks and Supporting Services: Define, configure, and validate the required zMFA started tasks and associated supporting services.
- Entra ID MFA Integration: Integrate zMFA with Microsoft Entra ID MFA services through RADIUS, where applicable, to enable MFA for supported interactive mainframe access methods.
- Interactive Access Integration: Integrate and validate MFA enforcement across applicable access paths, including:
- Time Sharing Option (TSO) access through TPX
- IBM Personal Communications (PCOMM)
- Web-based mainframe access tools
- User Enrollment Configuration: Design and configure the MFA enrollment process, including user onboarding and registration workflows.
- User Recovery and Troubleshooting: Establish and document recovery procedures for MFA re-registration, authentication token issues, and other enrollment or authentication-related problems.
- Testing and Validation: Perform integration testing, authentication flow validation, and troubleshooting to ensure the zMFA implementation operates as intended.
- Documentation and Handover: Maintain technical documentation covering architecture, configuration, operational procedures, troubleshooting, and support handover.