Identity Governance and Administration Senior Engineer - AVP

Do you want your voice heard and your actions to count?

Discover your opportunity with Mitsubishi UFJ Financial Group (MUFG), one of the world’s leading financial groups. Across the globe, we’re 150,000 colleagues, striving to make a difference for every client, organization, and community we serve. We stand for our values, building long-term relationships, serving society, and fostering shared and sustainable growth for a better world.

With a vision to be the world’s most trusted financial group, it’s part of our culture to put people first, listen to new and diverse ideas and collaborate toward greater innovation, speed and agility. This means investing in talent, technologies, and tools that empower you to own your career.

Join MUFG, where being inspired is expected and making a meaningful impact is rewarded.

The selected colleague will work at an MUFG office or client sites four days per week and work remotely one day. A member of our recruitment team will provide more details.

An exciting opportunity is available for a hands-on Identity Governance and Administration (IGA) Engineer to join the Global IAM Engineering team. The engineer will design, build, implement, maintain and operate the IGA platform that governs workforce and non-human access across MUFG's Americas, EMEA and Asia Pacific regions. This is an individual contributor engineering role at AVP level, focused on technical depth and delivery.

The engineer is expected to have deep knowledge of IGA across all domains and controls: identity lifecycle (joiner-mover-leaver), access request and approval, provisioning and de-provisioning, access certification, role and entitlement management, policy and segregation of duties (SoD), application onboarding, and non-human identity governance. The engineer must understand how each control is designed to work, how to implement it on the platform, and how to keep it operating reliably and in line with regulatory expectations.

The role follows an automation-first operating model. The engineer will build request and approval forms, workflows, rules and integrations so that IGA processes run end to end with minimal human intervention, and manual tasks, tickets and exceptions are steadily removed. Close integration with ServiceNow (catalog, request fulfilment, incident, problem and change) and with HR sources, directories, applications and Privileged Access Management (PAM) platforms through APIs and connectors is central to the role.

At AVP level, MUFG expects the engineer to work independently from requirement to production: translating control and business requirements into technical designs, building and testing solutions, supporting audit and evidence needs, and resolving complex production issues through structured troubleshooting and root cause analysis. The engineer is also expected to coach junior engineers, document designs and standards, and explain complex technical matters in plain English to technical and non-technical stakeholders, including HR, IT Risk, Compliance, Infrastructure and application owners.

Candidates must have 6-10 years of Identity & Access Management experience, including at least 4 years of hands-on IGA engineering experience (e.g. Omada, SailPoint, Saviynt, other). Candidates must also demonstrate sound Cyber Security and IAM fundamentals, either through recognized qualifications or proven experience, and practical insight gained in similar enterprise, ideally regulated financial services, environments.

Key Responsibilities

• IGA solution engineering: Design, configure, build, test and deploy IGA capabilities (lifecycle management, access requests, certifications, role and policy management, SoD, provisioning and reconciliation) from approved requirements and control designs.
• Control implementation: Implement advanced IGA controls (joiner-mover-leaver, birthright and role-based access, access recertification, SoD preventive and detective checks, orphan and dormant account handling, privileged and non-human identity governance) so that each control is automated, evidenced and traceable to regulatory and NIST-based control requirements.
• Forms, workflows and rules: Design and develop access request forms, approval and fulfilment workflows, lifecycle events, rules, transforms and notifications that are reusable, well documented and easy to support.
• Automation with minimal human intervention: Eliminate manual provisioning, approvals, reconciliation and certification tasks through event-driven workflows, rules, scheduled tasks and API automation, and track measurable reductions in manual effort, exceptions and ticket volume.
• Application onboarding and connectors: Onboard applications and authoritative sources (HR, directories, databases, cloud and SaaS platforms, mainframe and custom applications) using connectors, web services, JDBC, LDAP and SCIM, including correlation, aggregation and entitlement modelling.
• ServiceNow integration: Build and maintain bidirectional integrations between IGA and ServiceNow (catalog items and variables, request and task fulfilment, status and closure updates, incident, problem and change linkage) so that requests flow from submission to fulfilment without manual handling.
• API integration: Develop, secure and support REST/SOAP and SCIM API integrations with HR, ITSM, PAM, directory, cloud and data platforms, including authentication (OAuth/service accounts), error handling, retries, logging and monitoring.
• Troubleshooting and operations: Maintain and operate the platform day to day: monitor health, diagnose and resolve aggregation, provisioning, workflow, connector and integration failures, perform root cause analysis, and implement permanent fixes to reduce repeat incidents.
• Platform maintenance and release management: Support platform upgrades, patching, configuration management, environment promotion (development, test, production), disaster recovery readiness and release control, following SDLC and change management standards.
• Audit, compliance and reporting: Produce control evidence, reports and dashboards, support access certification campaigns, internal and external audit requests (SOX, regulatory reviews) and remediation tracking, and keep control documentation audit-ready.
• Data quality and identity integrity: Maintain accurate identity data, correlation and attribute mapping across HR and target systems, and identify and remediate data issues that cause incorrect access.
• Documentation and standards: Maintain technical designs, configuration standards, runbooks, knowledge articles and test evidence, and contribute to platform standards and engineering best practice.
• Collaboration and mentoring: Work with Security, IT Risk, Compliance, HR, Infrastructure, application owners, Service Desk and vendors, and coach junior engineers on IGA engineering practices.

 Skills and Experience:

• Experience: 6-10 years of IAM experience, including 4+ years of hands-on IGA engineering in enterprise, multi-region environments with large user populations (10,000+ users) and many applications.
• Deep IGA knowledge across all domains and controls: Identity lifecycle (joiner-mover-leaver), access request and approval, provisioning and reconciliation, access certification, RBAC and role mining or modelling, entitlement management, SoD and policy management, orphan and dormant account management, and non-human identity governance, with the ability to explain how each control works and how to implement and evidence it.
• IGA platform engineering: Proven delivery of connectors and application onboarding, aggregation and correlation, identity profiles and lifecycle states, transforms, rules, workflows, forms, certification campaigns, policies, reports and event triggers; strong understanding of platform architecture, virtual appliance or server components, and environment promotion.
• Forms and workflow design: Ability to design user-friendly request and approval forms and efficient, fault-tolerant workflows that enforce controls, minimize approvals and manual steps, and remain simple to maintain.
• ServiceNow: Hands-on experience integrating IGA with ServiceNow (service catalog, record producers and variables, Flow Designer or IntegrationHub, scripted REST APIs, RITM and task fulfilment, incident, problem and change processes) and a strong understanding of ITSM-aligned operations.
• API and integration skills: Strong experience with REST/SOAP web services, SCIM, JSON and XML, OAuth and token-based authentication, and tools such as Postman; able to build, test and debug integrations with HR systems, directories, databases, cloud and SaaS applications and PAM platforms.
• Scripting and development: 5+ years of automating processes through scripting or coding, with Java and BeanShell, JavaScript (Identity Security Cloud), and PowerShell and/or Python; ability to write SQL queries; familiarity with Git and CI/CD for controlled deployments.
• Troubleshooting: Demonstrated ability to troubleshoot complex production issues end to end (logs, task results, workflow traces, connector and API errors, performance), perform structured root cause analysis and deliver lasting fixes.
• Cyber Security and IAM fundamentals: Must demonstrate solid command of the basics, including authentication and authorization, SSO and federation (SAML, OAuth 2.0, OpenID Connect), MFA, least privilege, segregation of duties, Zero Trust principles, privileged access, directory services (Active Directory, Entra ID, LDAP), cloud identity concepts, and common identity threats and risks.
• Controls, audit and regulation: Sound understanding of IAM processes and controls, including external audit and SOX requirements, and good knowledge of control frameworks such as NIST, CRI, DORA and SOX; experience supporting evidence collection, control testing and remediation.
• Production and SDLC discipline: Experience with critical production support, application upgrades, project lifecycle and SDLC processes, release and change management, and ITSM practices (incident, problem, change, SLAs).
• Automation mindset: Track record of reducing manual effort and ticket volume through workflows, APIs and orchestration, with an interest in applying AI-assisted support under strong governance and auditability.
• Professional skills: Excellent written and verbal communication, structured problem solving, strong ownership and attention to detail, ability to work independently and as a team player, and the ability to explain technical topics clearly to senior and non-technical stakeholders.
• undefinedPreferred:IGA vendor certification such as SailPoint Certified Identity Security Engineer (Identity Security Cloud)Security and IAM certifications such as CISSP, CISM, CompTIA Security+, Microsoft SC-300 or equivalent professional qualificationsServiceNow certification (for example Certified System Administrator or Certified Application Developer) or demonstrable ServiceNow development experienceKnowledge of Privileged Access Management principles, processes and tools (for example CyberArk) and their integration with IGAExposure to cloud identity patterns (AWS, Azure, GCP), Microsoft Entra ID and CI/CD access modelsExperience applying AI agents or AI-assisted support in IT or security operations with strong governance and auditabilityFinancial Services experience and experience of financial regulations, compliance and standards is a bonusBachelor's degree in Computer Science or a related discipline 

Education:

•Bachelor’s degree in Computer Science or a closely-related discipline or relevant work experience

The typical base pay range for this role is as follows:

• New York / New Jersey: $125k - $153k
• Non-/New York/ New jersey: $112 - $141

depending on job-related knowledge, skills, experience and location. This role may also be eligible for certain discretionary performance-based bonus and/or incentive compensation. Additionally, our Total Rewards program provides colleagues with a competitive benefits package (in accordance with the eligibility requirements and respective terms of each) that includes comprehensive health and wellness benefits, retirement plans, educational assistance and training programs, income replacement for qualified employees with disabilities, paid maternity and parental bonding leave, and paid vacation, sick days, and holidays. For more information on our Total Rewards package, please click the link below.

Our hybrid work schedule is four days on-site and work remotely one day per week.

MUFG Benefits Summary

We will consider for employment all qualified applicants, including those with criminal histories, in a manner consistent with the requirements of applicable state and local laws (including (i) the San Francisco Fair Chance Ordinance, (ii) the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, (iii) the Los Angeles County Fair Chance Ordinance, and (iv) the California Fair Chance Act) to the extent that (a) an applicant is not subject to a statutory disqualification pursuant to Section 3(a)(39) of the Securities and Exchange Act of 1934 or Section 8a(2) or 8a(3) of the Commodity Exchange Act, and (b) they do not conflict with the background screening requirements of the Financial Industry Regulatory Authority (FINRA) and the National Futures Association (NFA). The major responsibilities listed above are the material job duties of this role for which the Company reasonably believes that criminal history may have a direct, adverse and negative relationship potentially resulting in the withdrawal of conditional offer of employment, if any.The above statements are intended to describe the general nature and level of work being performed. They are not intended to be construed as an exhaustive list of all responsibilities duties and skills required of personnel so classified.We are proud to be an Equal Opportunity Employer and committed to leveraging the diverse backgrounds, perspectives and experience of our workforce to create opportunities for our colleagues and our business. We do not discriminate on the basis of race, color, national origin, religion, gender expression, gender identity, sex, age, ancestry, marital status, protected veteran and military status, disability, medical condition, sexual orientation, genetic information, or any other status of an individual or that individual’s associates or relatives that is protected under applicable federal, state, or local law.