Information Security Risk Analyst II

CardWorks • Woodbury, MN

6d

About The Position

The IAM Analyst II executes and facilitates Identity and Access Management (IAM) detective controls that identify unauthorized, inappropriate, or unnecessary enterprise access. The role primarily supports User Access Reviews (UARs), including review preparation, data validation, reviewer coordination, completion monitoring, exception management, evidence retention, and remediation tracking. It also supports access reconciliations, authentication and privileged access reviews, access-related monitoring, and investigation of identified exceptions.

The analyst works with application owners, business stakeholders, IAM engineering, cybersecurity, risk management, and audit teams to ensure controls are consistently executed using complete and accurate data and remain audit-ready. The position calls for operational discipline, analytical skills, and knowledge of IAM concepts, along with the ability to coordinate recurring control activities across applications and stakeholders. The analyst is also expected to identify opportunities to improve control effectiveness, streamline processes, and reduce manual work through automation.

The role may be based in Woodbury, NY; Pittsburgh, PA; Orlando, FL; or South Jordan, UT. A hybrid or fully remote work model may be considered at the hiring manager’s discretion and based on role priorities. The stated salary range for NY Metro/NY State is $88,605 to $98,450; ranges vary by geographic area.

Requirements

• Bachelor’s degree in Information Security, Information Technology, Computer Science, Business, or a related discipline, or an equivalent combination of education and relevant experience.
• At least 3 years of experience in Identity and Access Management, information security, IT risk, IT controls, or a related technology function.
• At least 3 years of experience with SailPoint.
• Understanding of identity and access management concepts, including user access, entitlements, authentication, privileged access, and access governance.
• Strong organizational skills and ability to coordinate recurring control activities involving multiple applications, reviewers, and deadlines.
• Strong analytical skills, including the ability to work with access data, identify discrepancies, and investigate exceptions.
• High attention to detail in data validation, control execution, and evidence collection.
• Ability to facilitate User Access Reviews and communicate expectations to business and technology stakeholders.
• Ability to independently manage assigned control activities and appropriately escalate issues and risks.
• Strong written and verbal communication skills.
• Ability to document processes, control activities, findings, and remediation clearly and consistently.
• Ability to identify opportunities for process improvement and automation.
• Commitment to operational discipline, control effectiveness, and secure access practices.
• Experience analyzing user, account, role, entitlement, or application access data.
• Experience working with business and technology stakeholders to facilitate recurring control activities or resolve access-related issues.

Nice To Haves

• At least 1 year of experience with Delinea.
• Experience supporting or executing User Access Reviews, access certifications, access reconciliations, or similar identity and access controls.
• Experience supporting audit, risk, or compliance activities, particularly in a regulated environment.
• Familiarity with IAM, IGA, PAM, authentication, or access management technologies.
• Familiarity with data analysis, reporting, scripting, workflow, or automation technologies.
• Working knowledge of security and control frameworks such as SOX, SOC 1, SOC 2, or similar regulatory and compliance requirements.

Responsibilities

• Facilitate and execute IAM detective controls, primarily User Access Reviews and access certification activities.
• Coordinate assigned UARs end to end, including preparation, initiation, reviewer engagement, completion tracking, validation, and evidence retention.
• Perform completeness and accuracy procedures for access review populations and supporting data.
• Review control results to identify access exceptions, inappropriate access, policy violations, and other conditions requiring investigation or remediation.
• Support additional detective IAM controls, including access reconciliations, authentication configuration reviews, privileged access reviews, and other access-related monitoring.
• Maintain accurate documentation and evidence demonstrating control execution and completion.
• Escalate control issues, missed deadlines, data quality concerns, and potentially significant access findings to IAM management.
• Assist with automation of data collection, validation, reconciliation, reporting, evidence generation, and control workflows.
• Partner with IAM engineering and platform teams to improve control data, integrations, and automation capabilities.
• Participate in testing and validation of new or enhanced IAM control capabilities.

Benefits

• Competitive pay, including a bonus target or variable pay incentive program.
• Medical, dental, and vision benefits.
• 401(k) plan with company match.
• Short- and long-term disability.
• Wellness programs.
• Group life and AD&D insurance.
• Paid vacation, sick days, and bank holidays.
• Employee engagement activities, including Employee Appreciation Day, DEI Employee Resource Groups, corporate social responsibility, and service recognition.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level