Security Admin- Identity access management

Experience Profile
12+ years in Cybersecurity/IAM roles, including a minimum of 5 years of hands-on SailPoint and enterprise Active Directory/Entra ID administration; prior experience in financial services or another highly regulated, multi-country environment is strongly preferred.
Role Summary
Acts as the dedicated Cybersecurity/IAM counterpart to the Data Governance-led team, translating approved RBAC/ABAC role and coverage definitions into governed SailPoint roles and Active Directory/Entra ID security groups, and ensuring every entitlement change is provisioned, approved, recertified, and audited through the client's existing identity governance ecosystem.
Key Responsibilities
Co-author RBAC/ABAC policy definitions with the Data Governance Architects and Business Analyst, ensuring technical feasibility within SailPoint and AD/Entra ID.
Design and configure the role-to-group mapping schema between the entitlement taxonomy and Active Directory security groups.
Configure SailPoint roles, access request/approval workflows, and recertification campaigns aligned to SmartApproval and Firmwide Certification.
Configure Entra ID roles, access request/approval workflows, and recertification campaigns aligned to SmartApproval and Firmwide Certification.
Design SailPoint and Entra ID certification campaigns (scope, reviewers, frequency, and escalation rules) aligned to the tri-annual Firmwide Certification cycle.
Administer elevated-permission and break-glass access (HR-for-HR, Operating Committee, senior/peer) with documented approval chains.
Integrate SailPoint and Entra ID audit and certification events with Splunk for monitoring, alerting, and evidence capture.
Support UAT, negative testing, and production cutover for all IAM-layer components.
Co-author the IAM sections of the operational runbook and lead related knowledge-transfer sessions.

Required Technical Skills
Hands-on SailPoint (IdentityIQ or IdentityNow) role, workflow, and certification configuration.
Hands-on Entra ID role, workflow, and certification configuration.
Active Directory / Entra ID security-group administration at enterprise scale (multi-thousand group environments).
RBAC and ABAC policy design; entitlement/role-catalog modeling.
ServiceNow access-request/workflow integration.
Working knowledge of data-layer entitlement enforcement tools (e.g., Immuta, Databricks Unity Catalog) to align IAM groups with downstream policy consumption.
Scripting/API experience for SailPoint connectors and automation (e.g., PowerShell, Python, REST APIs).
Log/audit integration experience with SIEM platforms (Splunk preferred).
Experience operating within regulated, multi-country financial-services environments.
Certifications 
SailPoint Certified IdentityIQ Engineer / IdentityNow Engineer.
CISSP or CISM.
Microsoft Identity and Access Administrator (SC-300).
ITIL Foundation.