IAM Engineering Lead - CISO

Job information:

• Functional title – IAM Engineering Lead
• Department - CISO
• Corporate level - Director
• Report to – Head of Security Architecture, Design and Engineering
• Location – Iselin, New Jersey. Onsite 2 days per week

What you will be doing:

As Head of IAM Engineering, you will lead the strategic design, implementation, and governance of a comprehensive identity and access management program that protects CLS Services' most critical asset: trusted digital identity. This is a hybrid executive and technical role that bridges security, compliance, and business enablement in a highly regulated financial services environment.

You will be responsible for architecting and scaling identity systems across our workforce, customers, and machine identities—each with distinct risk profiles and regulatory demands. This includes accelerating onboarding of applications and infrastructure into our IGA platform, expanding our PAM scope to network devices and non-traditional endpoints, building a comprehensive secrets management capability, and embedding AI-assisted automation to reduce manual operational burden while maintaining security and auditability.

Key Responsibilities:

• Scale application and infrastructure onboardingto IAG through a phased, iterative deployment strategy, prioritizing critical systems and expanding coverage over time to maximize early wins while managing complexity.
• Automate provisioning and access reviews using IAG connectors, role-based access control (RBAC) frameworks, and AI-driven workflows to reduce manual errors and accelerate user lifecycle management.
• Implement self-service capabilities and identity workflow automation to automate and accelerate onboarding to the IAG platform.
• Maintain data quality and integration governance by establishing rigorous data cleansing practices, continuous syncing with authoritative HR systems, and monitoring to ensure accurate, consistent identity and entitlement data.
• Where possible Leverage AI and machine learning to generate role recommendations, detect over-permissioning, and automate access certification workflows at scale.
• Govern machine identities (workloads, services, future AI agents) through IAG lifecycle management, ensuring all identity types are managed through a unified access governance framework.
• Deploy behavioral anomaly detection using AI/ML to identify unauthorized or suspicious IAM activities, including potential abuse by rogue AI agents operating at machine velocity.
• Onboard critical device and infrastructure accounts to PAM, including network devices, databases, and cloud infrastructure, implementing just-enough-privilege (JEP) and just-in-time (JIT) access models to reduce standing privileges and blast radius.
• Expand PAM scope beyond Linux/Windowsto include network devices, databases, cloud infrastructure (AWS), and non-traditional endpoints (operational technology etc.) where applicable to CLS Services' infrastructure.
• Where possible Implement JIT and zero standing privileges (ZSP)across PAM-managed resources, restricting privilege duration and scope to specific use cases and time-bound sessions.

AI-Assisted IAM Operations

• Redistribute high-volume, low-risk IAM tasks to AI agents, such as routine provisioning, deprovisioning, access reviews, and anomaly detection, while maintaining human oversight, exception handling, and strategic decision-making.
• Implement AI-driven intelligent recommendations for access reviews, vulnerability remediation, and role engineering to accelerate decision cycles and improve accuracy.
• Design and monitor AI agent identity lifecycle management, including provisioning, fine-grained authorization, token monitoring, and continuous audit of AI agent activities to prevent privilege escalation or unauthorized data access.

Vendor and Technology Management

• Negotiate and manage vendor relationships to ensure technical roadmaps align with CLS Services' strategy, support regulatory requirements, and deliver value.

Measurement and Governance

• Define and track outcome-driven metrics aligned with business objectives, such as:
  • IGA onboarding cycle time and application/infrastructure coverage expansion
  • Reduction in identity-related security incidents and unauthorized access events
  • PAM scope expansion and just-in-time privilege adoption rates
  • User experience and self-service adoption metrics
  • AI recommendation accuracy and agent behaviour anomaly detection rates

Engineering Leadership & Operating Model

• Build and lead a high-performing security engineering function, aligned to product-based delivery.
• Help define the target operating model for security engineering, including platform ownership, DevSecOps integration, and automation-first principles.
• Establish clear engineering standards, patterns, and reusable security services.
• Experience with tooling selection, deployment and vendor management.
• Integration of tooling with downstream and upstream systems
• Tooling automation development
• Continuous Tooling Optimization
• Platform Health Monitoring
• Remediation Engineering
• Resiliency Engineering

Stakeholder Engagement & Strategy

• Work closely and partner with the ED, Head of Identity and Access Management.
• Partner with CIO, CISO, heads of technology and senior business leaders to align security engineering initiatives with organizational priorities.
• Work closely with the enterprise security architects and solution architects on control gaps, control maturity and business cases.
• Translate risk and threat insights into practical engineering outcomes.
• Manage vendor relationships and strategic technology partnerships.

What we’re looking for:

• Senior leadership in security engineering / cyber engineering in complex, regulated environments (markets technology / investment banking / FMI strongly preferred).
• Proven delivery of large-scale security platforms end-to-end (design → build → run), including multi-system integration.
• Deep experience identity & privileged access engineering.
• Strong track record of regulatory/audit engagement and evidence-based assurance.
• Engineering mindset: able to go deep on architecture, automation, telemetry, and operational resilience.
• Strategic thinker with the ability to translate vision into execution.
• Strong communicator, able to influence at executive level.
• Data-driven and outcome-focused, with a bias toward measurable security improvements.
• Comfortable operating in fast-paced, evolving environments.

Desirable Skills and Experience

• SailPoint IGA platform administration and customization (roles, policies, workflows, connectors)
• Delinea PAM platform expertise (credential management, session recording, just-in-time workflows)
• Cloud infrastructure security (AWS IAM)
• Identity and access intelligence (IAI) or AI/ML analytics applied to IAM use cases.

Professional qualifications / certifications

• Extensive experience in security engineering and architecture (~10 years), including ~5-7+ years in a senior leadership role.
• Experience in:
  • Working in highly regulated operations and complex organizational structures.
  • Reporting to senior leadership supporting executive level decision-making and prioritization.
  • Engaging in complex governance, contributing to multi-layered committees or forums.
• Understand, interpret and apply regulatory requirements, compliance and industry standards.