Cybersecurity Engineer

About Us
Visa is a world leader in payments technology, facilitating transactions between consumers, merchants, financial institutions and government entities across more than 200 countries and territories, dedicated to uplifting everyone, everywhere by being the best way to pay and be paid.

At Visa, you'll have the opportunity to create impact at scale — tackling meaningful challenges, growing your skills and seeing your contributions impact lives around the world.

Join Visa and do work that matters – to you, to your community, and to the world. Progress starts with you.

Job Description

Role Summary:
The Cybersecurity Analyst – IAM supports the operation of identity and access management controls across the Pismo platform,

helping ensure compliance with the Visa Corporate Identity & Access Technical Security Requirements.

Working with senior IAM engineers, the analyst operates and continuously improves access controls for human and non-human identities

across AWS and hybrid environments: running access reviews, analysing permissions, monitoring privileged access, maintaining identity

inventories and automating recurring tasks.

The role partners with Cloud Security, Platform Engineering, API, DevSecOps and GRC teams to apply least-privilege and zero-trust

practices in a regulated, multi-tenant payments environment.

The role also supports the governance of AI-enabled identity use cases. It keeps track of the identities, credentials and permissions

used by AI systems, agents and automation, and checks them against Internal AI Governance standards and Corporate IAM requirements.

Key Responsibilities

Access governance

• Run periodic user access reviews and recertifications for Pismo applications and components, and collect, reconcile and keep the evidence.

• Monitor joiner, mover and leaver events and confirm that access is granted, changed and removed on time across the identity provider,

cloud accounts, source control and Kubernetes clusters.

• Review access requests and permission changes, including group, role and permission-set changes submitted as code, for least privilege

and separation of duties.

Permissions and privileged access

• Analyse cloud and platform permissions to find excessive, unused or orphaned access, and track remediation with the owning teams.

• Monitor privileged, just-in-time and break-glass access, investigate deviations and report exceptions.

• Keep the role and entitlement catalogue and the access matrix of each application up to date.

Non-human identities

• Maintain the inventory of service accounts, workload roles, API credentials and AI agent identities, with owner, purpose, permissions

and application mapping.

• Check that non-human identities meet the standards for ownership, scope, credential rotation and expiry.

Automation

• Write and maintain scripts and automations that use identity and cloud APIs and SDKs to extract access data, produce reports and automate recurring checks.

• Make changes to existing Terraform-based/ AWS automation IAM definitions through the standard review process.

Compliance and reporting

• Support internal and external audits and Visa security assessments (PCI DSS, ISO 27001, SOC 2) with access-control evidence and control testing.

• Track IAM findings and exceptions through to closure, and report status and metrics to IAM leadership.

• Write and maintain runbooks, procedures and documentation for IAM processes.

This is a hybrid position. Visa requires at least 3 days in office, expectations of these days will be confirmed by your Hiring Manager.

Qualifications

Basic Qualifications:

• 2+ years of relevant work experience and a Bachelor's degree, OR 5+ years of relevant work experience. Master's graduates must have 2+ years of relevant work experience to qualify at the Analyst (I5) level.

Preferred Qualifications:

• 3 or more years of work experience with a Bachelor's Degree or more than 2 years of work experience with an Advanced Degree (e.g., Master's, MBA, JD, MD).
• 2+ years of hands-on experience in identity and access management, cloud security or security operations.
• Experience administering or operating an enterprise identity provider (Okta preferred, or Microsoft Entra ID), including SSO (SAML/OIDC), MFA, groups and group rules, and lifecycle provisioning (SCIM).
• Working knowledge of AWS IAM: roles, policies and trust policies, IAM Identity Center permission sets, and the ability to read and evaluate policy documents. Exposure to Azure or GCP IAM is a plus.
• Understanding of RBAC and ABAC, least privilege, separation of duties, and just-in-time and break-glass access.
• Experience running access reviews or certifications and supporting joiner/mover/leaver processes.
• Scripting in Python or an equivalent language, including calls to REST APIs and SDKs (e.g. Okta API, AWS SDK).
• Ability to read and change Terraform, and to work with Git and pull requests.
• Familiarity with Kubernetes RBAC and service accounts.
• Knowledge of the access-control requirements in PCI DSS (Requirements 7 and 8), ISO 27001 and NIST SP 800-53 (AC family).
• Clear written communication, including documentation and audit evidence.
• Relevant certifications are a plus but not mandatory, such as Okta Certified Administrator, Microsoft SC-300, AWS Certified Solutions Architect – Associate or Security – Specialty, or CompTIA Security+.

Information for US Applicants

For roles located in the US, the estimated salary range for this position is $112.100,00 to $ 173.400,00 USD per year, which may include potential sales incentive payments (if applicable). Salary may vary depending on job-related factors which may include knowledge, skills, experience, and location. In addition, this position may be eligible for bonus and equity.Visa has a comprehensive benefits package for which this position may be eligible that includes Medical, Dental, Vision, 401(k), FSA/HSA, Life Insurance, Paid Time Off, and Wellness Program.

Work Hours

Varies upon the needs of the department.

Travel Requirements

This position requires travel 5-10% of the time.

Mental/Physical Requirements

This position will be performed in an office setting. The position will require the incumbent to sit and stand at a desk, communicate in person and by telephone, frequently operate standard office equipment, such as telephones and computers.

Visa is an EEO Employer

Qualified applicants will receive consideration for employment without regard to race, color religion, sex, national origin, sexual orientation, gender identity, disability or protect veteran status. Visa will also consider for employment qualified applicants with criminal histories in a manner consistent with the EEOC guidelines and applicable local law.