OneAZ Credit Union

Member-owned financial services and loans

IAM Governance Analyst

Security Governance, Risk & CompliancePosted on Nov 10

Full-timePhoenix, AZ, USA$73.8k - $92.2kIn-person

About the Job

Requirements

A high school diploma or GED is required.
Three to five years of similar or related experience in IAM governance, information security governance, technology controls, GRC, security engineering or operations, systems administration, or related work; equivalent experience may be considered.
Experience in banking, credit unions, financial services, or another regulated environment.
Experience with IGA/PAM capabilities, Entra Identity Governance, PIM, access certification, or role/entitlement governance.
Practical understanding of Active Directory, Microsoft Entra ID, Microsoft 365, MFA, SSO, Conditional Access, RBAC, least privilege, segregation of duties, privileged access, access reviews, identity lifecycle controls, and federation concepts such as SAML, OAuth 2.0, and OpenID Connect.
Ability to analyze processes and access data, challenge technical stakeholders, identify control weaknesses, document requirements, evaluate evidence, and coordinate cross-functional remediation without assuming operational ownership.
Ability to communicate clearly with technical teams, business owners, management, Risk, Compliance, and Audit.
Knowledge of NIST, FFIEC, GLBA, CIS Controls, or comparable frameworks and regulatory expectations.
Security+, CISA, CRISC, CISSP, or a relevant IAM/security certification.

Responsibilities

Provide Information Security governance and assurance over identity and access management controls by assessing control design and performance, coordinating reviews, validating evidence, measuring risk, reporting results, and escalating unresolved gaps while maintaining separation from routine IAM operations and engineering.
Contribute to the review and maturity of joiner, mover, and leaver controls across HR, IT, Information Security, and application owners.
Map current-state workflows; identify gaps in approvals, provisioning, modification, termination, timeliness, and evidence; and validate control evidence on a risk-based basis.
Establish governance checkpoints, monitor exceptions, and track recurring failures to the accountable process or technology owner.
Coordinate periodic access certifications for critical applications, privileged roles, and other risk-based populations.
Establish review scope, owner and reviewer accountability, evidence expectations, completion tracking, escalation paths, and remediation follow-through.
Verify that business and application owners determine whether access remains appropriate and that resulting removals or corrections are completed and evidenced.
Develop and maintain governance visibility into critical roles, entitlements, access owners, and approval requirements.
Analyze access data for excessive privilege, conflicting permissions, orphaned access, role drift, and unclear business justification without directly provisioning or modifying entitlements.
Advise business and application owners on role definitions, approval requirements, and least-privilege alignment.
Establish governance expectations for privileged accounts, service accounts, shared accounts, emergency accounts, API or service identities, and other non-human identities.
Assess whether these identities have documented business purpose, accountable ownership, appropriate authentication expectations, lifecycle controls, periodic review, and supporting evidence.
Coordinate remediation with the accountable IT, PAM, or platform owner and validate closure evidence.
Assess and provide governance oversight of Entra ID and Microsoft 365 identity controls, including MFA, SSO, Conditional Access, privileged roles, PIM/PAG, access reviews, risky identities, authentication methods, and related exceptions.
Evaluate identity-risk trends and control findings, advise accountable technology owners, and track governance improvements without assuming routine tenant administration or configuration responsibilities.
Evaluate IAM control design and operating evidence on a risk-based basis, identify gaps, and document whether controls are operating as intended.
Validate remediation evidence and maintain evidence packages that support audits, regulatory examinations, risk assessments, and internal control reviews.
Require appropriate evidence or documented risk treatment before closing material findings; do not close material findings solely on verbal confirmation.
Develop decision-useful IAM metrics, including JML timeliness, access-review completion, remediation aging, stale or orphaned identities, privileged-access exceptions, non-human identity ownership, and overdue reviews.
Use metrics and trends to identify risk, monitor remediation, and escalate unresolved control gaps through Information Security governance and risk channels.
Translate IAM findings into concise management reporting and decision-ready risk statements.
Identify process-improvement and automation opportunities based on control findings, metrics, and recurring exceptions.
Contribute governance and control requirements for future IAM or IGA capabilities and support IAM roadmap development.
Advise implementation teams and validate that delivered capabilities address approved requirements; implementation and ongoing administration remain with the accountable technology owner.

Join Us in Making an Impact ✨

At OneAZ Credit Union, our success is measured only by yours. We’re here to create lasting change in the lives of our members, our communities, and our team. If you're looking for a career with purpose, where your work truly matters—you've found it!

Who You Are 🧩

You’re impactful, compassionate, and fearless, ready to embrace new challenges and shape the future of financial well-being. You take accountability for our success and thrive in an environment where curiosity is celebrated. If this sounds like you, let’s build something great together.

What You’ll Do 🚀

📍This position will be located at our Corporate Office: 2355 W Pinnacle Peak Rd, Phoenix, AZ 85027

The IAM Governance Analyst provides Information Security governance and assurance over identity and access management controls. The analyst assesses control design and performance, coordinates reviews, validates evidence, measures risk, reports results, and escalates unresolved gaps while maintaining clear separation from routine IAM operations and engineering.

Essential Functions

Identity Lifecycle Governance
Contribute to the review and maturity of joiner, mover, and leaver controls across HR, IT, Information Security, and application owners.
Map current-state workflows; identify gaps in approvals, provisioning, modification, termination, timeliness, and evidence; and validate control evidence on a risk-based basis.
Establish governance checkpoints, monitor exceptions, and track recurring failures to the accountable process or technology owner.
Coordinate periodic access certifications for critical applications, privileged roles, and other risk-based populations.
Establish review scope, owner and reviewer accountability, evidence expectations, completion tracking, escalation paths, and remediation follow-through.
Verify that business and application owners determine whether access remains appropriate and that resulting removals or corrections are completed and evidenced.
Develop and maintain governance visibility into critical roles, entitlements, access owners, and approval requirements.
Analyze access data for excessive privilege, conflicting permissions, orphaned access, role drift, and unclear business justification without directly provisioning or modifying entitlements.
Advise business and application owners on role definitions, approval requirements, and least-privilege alignment.
Establish governance expectations for privileged accounts, service accounts, shared accounts, emergency accounts, API or service identities, and other non-human identities.
Assess whether these identities have documented business purpose, accountable ownership, appropriate authentication expectations, lifecycle controls, periodic review, and supporting evidence.
Coordinate remediation with the accountable IT, PAM, or platform owner and validate closure evidence.
Assess and provide governance oversight of Entra ID and Microsoft 365 identity controls, including MFA, SSO, Conditional Access, privileged roles, PIM/PAG, access reviews, risky identities, authentication methods, and related exceptions.
Evaluate identity-risk trends and control findings, advise accountable technology owners, and track governance improvements without assuming routine tenant administration or configuration responsibilities.
Evaluate IAM control design and operating evidence on a risk-based basis, identify gaps, and document whether controls are operating as intended.
Validate remediation evidence and maintain evidence packages that support audits, regulatory examinations, risk assessments, and internal control reviews.
Do not close material findings solely on verbal confirmation; require appropriate evidence or documented risk treatment.
Develop decision-useful IAM metrics, including JML timeliness, access-review completion, remediation aging, stale or orphaned identities, privileged-access exceptions, non-human identity ownership, and overdue reviews.
Use metrics and trends to identify risk, monitor remediation, and escalate unresolved control gaps through Information Security governance and risk channels.
Translate IAM findings into concise management reporting and decision-ready risk statements.
Identify process-improvement and automation opportunities based on control findings, metrics, and recurring exceptions.
Contribute governance and control requirements for future IAM or IGA capabilities and support IAM roadmap development.
Advise implementation teams and validate that delivered capabilities address approved requirements; implementation and ongoing administration remain with the accountable technology owner.

What You Bring🎯

High School Diploma or GED Required
3-5 years similar or related experience in IAM governance, information security governance, technology controls, GRC, security engineering or operations, systems administration, or related work; equivalent experience may be considered. Required
Experience in banking, credit unions, financial services, or another regulated environment.
Experience with IGA/PAM capabilities, Entra Identity Governance, PIM, access certification, or role/entitlement governance.
Practical understanding of Active Directory, Microsoft Entra ID, Microsoft 365, MFA, SSO, Conditional Access, RBAC, least privilege, segregation of duties, privileged access, access reviews, identity lifecycle controls, and federation concepts such as SAML, OAuth 2.0, and OpenID Connect.
Demonstrated ability to analyze processes and access data, challenge technical stakeholders, identify control weaknesses, document requirements, evaluate evidence, and coordinate cross-functional remediation without assuming operational ownership.
Ability to communicate clearly with technical teams, business owners, management, Risk, Compliance, and Audit.
Knowledge of NIST, FFIEC, GLBA, CIS Controls, or comparable frameworks and regulatory expectations.
Security+, CISA, CRISC, CISSP, or relevant IAM/security certification.

Compensation & Benefits 🎉

Generous paid time off: paid holidays, floating holidays, personal days, vacation days, plus sick time, Low-cost Medical, Dental & Vision plans
Paid childcare assistance
Award-winning 401K
Gym fee reimbursement
Tuition Reimbursement
Student loan repayment
...and much more. Explore all the details in our comprehensive Benefits Booklet
Target hiring range $73,768.57 - $92,210.71 (Depending on experience and prior to any incentives this position is eligible for)

Why Join OneAZ?

At OneAZ, we’re not just a credit union; we’re a financial trailblazer that passionately cares about inspiring dreams and driving prosperity in the communities we serve. We exist to clear the way for dreamers and doers, aspiring to be the bank for new pioneers.

We are driving change in our communities, constantly improving our products and services so our members and their families can relentlessly pursue their dreams. By embodying our values and living our promise, you’ll be part of a team committed to exceeding expectations and redefining what’s possible.

Additional Notes:

Knowingly submitting false information will result in disqualification for consideration of future positions, termination of employment and forfeiture of other rights. Candidates for this position will be required to sign an authorization for OneAZ to conduct a credit and criminal background check, pursuant to procedures in the Fair Credit Reporting Act and any other applicable laws. All candidates will be considered for this position on an individualized basis, in compliance with all applicable equal employment opportunity laws. Any individual who meets the definition of a mortgage loan originator (MLO) and is employed by a federal agency-regulated institution will need to be registered on the Nationwide Mortgage Licensing System (NMLS). Ensures compliance with applicable policies, laws, and regulations, including the Bank Secrecy Act (BSA), Anti-Money Laundering (AML) compliance, USA Patriot Act, and Office of Foreign Assets Control (OFAC). This job description should not be considered all-inclusive. It is merely a guide of expected duties. The associate understands that the job description is neither complete, nor permanent and may be modified at any time. At the request of their supervisor, an associate may be asked to perform additional duties or take on additional responsibilities without notice. Complies with all policies and standards. Position grades could fluctuate based on market value.

About the Company

OneAZ Credit Union

Member-owned financial services and loans

OneAZ Credit Union is a member-owned financial institution that serves Arizona with checking and savings accounts, loans, and other financial services through its 20 branches and online channels. It works by pooling members’ deposits to fund loans and provide digital banking, ATMs, and customer services, offering competitive rates and tailored financial products to individuals and small businesses. What sets OneAZ apart from many competitors is its status as a large, nonprofit credit union with a strong community focus, backed by recognition from Forbes, Newsweek, and Healthiest Employers for its workplace and service quality. Its goal is to inspire dreams and drive prosperity and community growth by delivering affordable financial solutions and accessible banking to its members.

Company size: 201-500
Company stage: Not listed
Total funding: Not listed
Headquarters: Phoenix, AZ
Founded: 1951

Recently Posted Jobs

Explore more opportunities at OneAZ Credit Union

See more jobs