Head of Identity and Access Management (IAM) & Privileged Access Management (PAM)

About the Role

Lead the delivery of secure, scalable Identity and Access Management (IAM) and Privileged Access Management (PAM) projects, ensuring alignment with regulatory, risk, and business objectives. Drive identity modernisation, strengthen access controls, and ensure compliance through effective governance, stakeholder engagement, and end-to-end execution.

Responsibilities

• Lead the end-to-end delivery of cybersecurity and identity transformation programmes in a highly regulated banking environment, focusing on IAM, PAM, and Zero Trust architectures aligned to the enterprise security strategy.
• Drive key initiatives including:
  • Unstructured Data Access Governance (Folder Access Management)
  • Audit & Regulatory Remediation
  • Enterprise Password & Authentication Modernisation to meet internal audit and external regulatory expectations.
• Provide hands-on leadership across:
  • Identity Lifecycle Management
  • Privileged Access Controls
  • Data Security
  • Cloud Identity (Entra ID / Azure AD) ensuring secure access across hybrid and multi-cloud environments.
• Deliver large-scale rollouts of:
  • Multi-Factor Authentication (MFA)
  • Passwordless authentication
  • Strong customer/employee authentication controls in compliance with banking regulations (e.g., PSD2 SCA).
• Oversee integration of identity systems such as:
  • Active Directory
  • Entra ID (Azure AD)
  • Access Request System (ARS)
  • Cloud platforms ensuring secure interoperability and adherence to least-privilege principles.
• Lead cross-functional teams (security, infrastructure, application, risk, compliance, third-party vendors) to deliver programmes against scope, budget, timelines, and quality standards in complex banking environments.
• Ensure adherence to:
  • Regulatory frameworks (e.g., PRA/FCA expectations)
  • Audit frameworks (e.g., SOX ITGC controls, internal audit findings)
  • Risk frameworks (e.g., PKI / Certificate Authority solutions, cross-entity trust)
• Establish and manage:
  • Risk frameworks
  • Dependency frameworks
  • Control frameworks for timely remediation of vulnerabilities, audit gaps, and control deficiencies.
• Produce and present executive-level reporting, including:
  • KPIs & KRIs
  • Risk posture
  • Programme health to senior stakeholders, risk committees, and governance forums.
• Drive standardisation, automation, and continuous improvement across cybersecurity delivery practices, embedding secure-by-design and Zero Trust principles across the bank.