Manager, Identity and Access Management

Operating in the UAE for over 50 years, this leading financial institution manages the financial requirements of some of the largest corporates and businesses operating in the country, driving the UAE economy. The bank has transformed into a progressive and modern banking institution, winning multiple awards for its digital initiatives and services. As it continues to build upon its successes, the bank seeks ambitious individuals who are passionate about the banking and finance industry and who can deliver exceptional service.

About the Role
This position is focused on managing Identity and Access Management (IAM) governance and oversight within the CISO Office, functioning as a second line of defense. The role supports the development and maintenance of IAM strategy, policies, standards, risk oversight, and the target operating model across various identity types, including human, privileged, non-human, and AI-agent identities. The individual will provide independent review, challenge, and monitoring of first-line IAM implementation and operations, ensuring that access is governed throughout its lifecycle and conforms to the bank's risk appetite and regulatory requirements.

Principal Accountabilities:

• Manage the IAM governance and oversight activities of the CISO Office and support the development, implementation, and periodic review of the Bank’s IAM strategy, policies, standards, risk framework, and roadmap.
• Provide independent second-line oversight, advice, and challenge over first-line IAM design, implementation, and operation.
• Maintain clear separation between CISO Office oversight and first-line ownership of IAM platforms, administration, and control execution.
• Manage team performance and support the continued development of IAM capability and sustainable governance practices.
• Support the development and maintenance of the enterprise IAM operating model with clear accountability across Business, Technology, Human Resources, and Risk. Monitor implementation of agreed responsibilities and escalate material gaps or areas of unclear ownership.
• Develop, maintain, and monitor compliance with standards for identity lifecycle management, least privilege, access models, segregation of duties, privileged access, recertification, and timely access removal.
• Independently review role models, security matrices, control designs, exceptions, and risk acceptances.
• Develop and maintain control-testing and continuous-monitoring requirements, track remediation of identified weaknesses, and escalate material or overdue issues.
• Develop and maintain IAM security principles and minimum requirements across identity governance, authentication, privileged access, directories, cloud, customer, and machine identities.
• Review and challenge IAM controls for new platforms, applications, cloud services, and material changes.
• Oversee application onboarding to IAM and Identity Governance Administration (IGA) platforms through governance gates and independent control validation, while Technology retains delivery and operational accountability.
• Maintain and monitor the IAM roadmap and provide risk-based input and challenge regarding investment, architecture, and automation priorities.
• Develop, implement, and maintain governance requirements for AI agents, service accounts, workloads, bots, APIs, and other non-human identities with unique identities, defined purposes, risk classification, accountable owners, and controlled lifecycles.
• Set requirements for approvals, credentials, delegated authority, time-bound access, monitoring, suspension, and decommissioning.
• Oversee agent access controls, human approval gates, and auditable activity in coordination with AI Governance, Data, Privacy, and Technology stakeholders.
• Maintain the IAM risk profile, including control effectiveness, residual risk, exceptions, and remediation priorities.
• Support the translation of regulatory, policy, and risk appetite requirements into IAM controls, Key Risk Indicators (KRIs), and oversight plans.
• Coordinate CISO Office engagement on IAM audits and regulatory reviews, ensuring accurate findings, complete evidence, and clear first-line ownership.
• Review exceptions and risk acceptances, escalating material or overdue exposures.
• Oversee IAM resilience, recovery, incident readiness, and emergency access arrangements.
• Must be available to provide out-of-hours and weekend support when required for material IAM incidents, urgent risk matters, regulatory requests, or critical business events.
• Report IAM risks, KRIs, control effectiveness, access review outcomes, exceptions, and transformation progress.
• Provide independent, risk-based advice and constructive challenge to relevant stakeholders and management.
• Develop and maintain IAM supplier control requirements and monitor material service, control, and concentration risks.
• Maintain authoritative IAM policies, standards, risk assessments, and governance records.

Requirements

• Education and Experience:
  • Bachelor’s degree in information security, Cybersecurity, Computer Science, Information Technology, Engineering, Risk Management, or a related discipline; a relevant postgraduate qualification is advantageous.
  • Professional certification in identity, cybersecurity, or technology risk, such as CISSP, CISM, CRISC, CCSP, or a recognized IAM/IGA/PAM certification, is preferred.
  • Typically 8–12 years of relevant experience across IAM, cybersecurity, technology risk, or control functions, including experience managing IAM governance, assurance, or oversight activities within banking or another regulated environment.
  • Demonstrated experience managing or supporting IAM governance and oversight within a second-line, security-risk, or equivalent independent control function, with a strong understanding of first-line technology and operational delivery.
  • Experience contributing to the development and implementation of IAM strategy, policies, control frameworks, target operating models, responsibility-assignment arrangements, and transition roadmaps across organizational boundaries.
  • Strong practical knowledge of IGA, PAM, access management, federation, SSO, MFA/passwordless authentication, directories, identity lifecycle, RBAC/ABAC, segregation of duties, APIs, and cloud/workload identity.
  • Experience assessing non-human identities, service principals, or AI agents, including credential management, delegated authorization, traceability, monitoring, and lifecycle controls.
  • Experience in risk assessment, independent challenge, control testing, audit and regulatory engagement, remediation tracking, management reporting, and effective stakeholder engagement.
  • Strong knowledge of banking operations, information security, privacy, resilience, and regulatory expectations relevant to identity and access management.