Identity and Access Monitoring (IAM) and Control Specialist

Job Description:

What you can expect in Identity & Access Management:

In today’s highly connected world, managing and securing human and machine identities is essential to the safety and success of our workforce. The Identity & Access Management (IAM) team works within Global Information Services (GIS) and in close participation with all other Line of Business teams as well as second and third line of defense partners. The IAM function is aligned to provide a centralized governance model, driving consistency through end-to-end horizontal risk oversight as well as vertical functional capabilities that provide comprehensive subject matter expertise on all IAM systems and services. This role is highly visible and requires frequent interaction with senior management and key stakeholders.  You will be responsible for facilitating adherence to IAM requirements, monitoring compliance, identifying non adherence, and supporting remediation of identified risks and issues across the IAM space.  

Responsibilities:
•    Support planning, development, and delivery of IAM governance processes and technical solutions which elevate security, improve compliance, and automate governance activities for applications, infrastructure, and processes.
•    Own identity lifecycle and access governance activities including developing, maintaining, and facilitating the adoption of IAM policy standards, processes, and procedures.
•    Coordinate and respond to regulatory, audit, and compliance requests. 
•    Aid in the automation of audit/compliance evidence gathering and metrics reporting .
•    Collaborate with first, second, and third line of defense partners to develop cutting-edge IAM policies and standards that iteratively support IAM enhancements across process, data, and technology.
•    Engage with engineers to drive the strategic technology roadmap, which dictates the need for modernized security principles.
•    Engage and consult with all IAM capabilities to identify gaps and establish solutions to close gaps.
•    Maintain end to end processes across the IAM space with aligned controls and metrics to evaluate control effectiveness.
•    Coordinate responses to internal audit requests and regulatory exams.
•    Apply defined best practices, templates, and documentation while also proposing improvements based on practical knowledge.
•    Articulate the reasons and methods behind proposed changes through informative materials for educating others.

Preferred Qualifications:
•    Hands on experience with authentication, privileged access management, and IAM enforcement in public clouds are essential for this role.
•    Ability to manage data and conduct data analytics, resulting in actionable insights. 
•    Demonstrated understanding of zero trust principles and techniques. 
•    Knowledge and understanding of IAM-specific laws, rules, and regulations within the financial services sector.
•    Familiarity with NIST 800-53, COBIT, COSO, and/or ISO, and attack frameworks such as MITRE.
•    A Bachelor's and/or Master's degree in Computer Science or Information Systems Security certifications (e. g. , CISSP, CISM, CGEIT, SSCP, Security+).
•    Knowledge of risk assessment tools, technologies, and methods. 
•    Experience planning, researching and developing security strategies, standards, and procedures.
 

About Bank of America – Global Technology:

Global Technology delivers technology services globally across the bank’s eight lines of business that serve individuals, companies, and institutions. The team also focuses on digital banking, payments, infrastructure, data management and technology that enhances cyber security, and risk and capital management. Innovation is at the heart of all Global Technology does.

Enterprise Role Overview - Operates tools and processes that provide cybersecurity defense. Uses technical expertise to provide systems disruption protection (DDoS), systems intrusion protection (IDS/IPS, WAF, Log Monitoring), network boundary protection (NAC, Firewalls), detects/prevents malware threats for applications and infrastructure and protects data leakage. Utilizes experience and deep knowledge of IT platforms, tools, and concepts to ensure cybersecurity protection is integrated into all layers of defense. Provides regular status updates to management team. Typically has 3-5 years of relevant experience in one or more threat prevention disciplines.

Shift:

Hours Per Week: