IAM Governance Analyst

OneAZ Credit Union•Phoenix, AZ

4h•$73,769 - $92,211•Onsite

About The Position

The IAM Governance Analyst provides Information Security governance and assurance over identity and access management controls. The analyst assesses control design and performance, coordinates reviews, validates evidence, measures risk, reports results, and escalates unresolved gaps while maintaining separation from routine IAM operations and engineering. The role contributes to governance of identity lifecycle processes, access certifications, privileged and non-human identities, and Entra ID and Microsoft 365 identity controls. It evaluates access data and control evidence, coordinates remediation with accountable owners, and maintains evidence packages supporting audits, regulatory examinations, risk assessments, and internal control reviews. The analyst develops IAM metrics and management reporting, identifies process-improvement and automation opportunities, and contributes governance requirements to future IAM or IGA capabilities and roadmap development. Implementation and ongoing administration remain with the accountable technology owner. The position is located at OneAZ Credit Union’s Corporate Office at 2355 W Pinnacle Peak Rd, Phoenix, AZ 85027.

Requirements

High school diploma or GED.
3–5 years of similar or related experience in IAM governance, information security governance, technology controls, GRC, security engineering or operations, systems administration, or related work; equivalent experience may be considered.
Experience in banking, credit unions, financial services, or another regulated environment.
Practical understanding of Active Directory, Microsoft Entra ID, Microsoft 365, MFA, SSO, Conditional Access, RBAC, least privilege, segregation of duties, privileged access, access reviews, identity lifecycle controls, and federation concepts such as SAML, OAuth 2.0, and OpenID Connect.
Ability to analyze processes and access data, challenge technical stakeholders, identify control weaknesses, document requirements, evaluate evidence, and coordinate cross-functional remediation without assuming operational ownership.
Ability to communicate clearly with technical teams, business owners, management, Risk, Compliance, and Audit.
Knowledge of NIST, FFIEC, GLBA, CIS Controls, or comparable frameworks and regulatory expectations.

Nice To Haves

Experience with IGA/PAM capabilities, Entra Identity Governance, PIM, access certification, or role/entitlement governance.
Security+, CISA, CRISC, CISSP, or a relevant IAM/security certification.

Responsibilities

Contribute to review and maturity of joiner, mover, and leaver controls across HR, IT, Information Security, and application owners.
Map current-state workflows; identify gaps in approvals, provisioning, modification, termination, timeliness, and evidence; and validate control evidence on a risk-based basis.
Establish governance checkpoints, monitor exceptions, and track recurring failures to the accountable process or technology owner.
Coordinate periodic access certifications for critical applications, privileged roles, and other risk-based populations.
Establish access-review scope, owner and reviewer accountability, evidence expectations, completion tracking, escalation paths, and remediation follow-through.
Verify that business and application owners determine whether access remains appropriate and that resulting removals or corrections are completed and evidenced.
Develop and maintain governance visibility into critical roles, entitlements, access owners, and approval requirements.
Analyze access data for excessive privilege, conflicting permissions, orphaned access, role drift, and unclear business justification without directly provisioning or modifying entitlements.
Advise business and application owners on role definitions, approval requirements, and least-privilege alignment.
Establish governance expectations for privileged accounts, service accounts, shared accounts, emergency accounts, API or service identities, and other non-human identities.
Assess identity business purpose, accountable ownership, authentication expectations, lifecycle controls, periodic review, and supporting evidence.
Coordinate remediation with accountable IT, PAM, or platform owners and validate closure evidence.
Assess and provide governance oversight of Entra ID and Microsoft 365 identity controls, including MFA, SSO, Conditional Access, privileged roles, PIM/PAG, access reviews, risky identities, authentication methods, and related exceptions.
Evaluate identity-risk trends and control findings, advise accountable technology owners, and track governance improvements without assuming routine tenant administration or configuration responsibilities.
Evaluate IAM control design and operating evidence on a risk-based basis, identify gaps, and document whether controls are operating as intended.
Validate remediation evidence and maintain evidence packages supporting audits, regulatory examinations, risk assessments, and internal control reviews.
Require appropriate evidence or documented risk treatment before closing material findings; do not rely solely on verbal confirmation.
Develop IAM metrics, including JML timeliness, access-review completion, remediation aging, stale or orphaned identities, privileged-access exceptions, non-human identity ownership, and overdue reviews.
Use metrics and trends to identify risk, monitor remediation, and escalate unresolved control gaps through Information Security governance and risk channels.
Translate IAM findings into concise management reporting and decision-ready risk statements.
Identify process-improvement and automation opportunities based on control findings, metrics, and recurring exceptions.
Contribute governance and control requirements for future IAM or IGA capabilities and support IAM roadmap development.
Advise implementation teams and validate that delivered capabilities address approved requirements; implementation and ongoing administration remain with the accountable technology owner.