Manager, Identity and Access Management (IAM)

Tampa General Hospital•Tampa, FL

About The Position

The Manager, Identity and Access Management (IAM) is a cybersecurity leadership role at Tampa General Hospital, responsible for safeguarding enterprise identity and access systems. The position oversees the Identity Engineering and Epic Security teams, which manage identity lifecycle processes, authentication, privileged access, and security for clinical applications. The manager ensures that access to enterprise systems, sensitive information, and clinical applications is accurately designed, provisioned, monitored, and governed. The manager leads the deployment and optimization of identity technologies, including directories, single sign-on, multifactor authentication, privileged access management, certificates, and machine identities. The role advances passwordless authentication, federation, conditional access, and related identity security controls using platforms such as Ping Identity, CyberArk, Venafi, Microsoft Entra ID, and Active Directory. The manager also directs Epic Security, ensuring access to the electronic health record and clinical systems aligns with workforce roles, least-privilege principles, and regulatory requirements. The position develops IAM strategies and technical standards, fosters collaboration, and ensures compliance with healthcare security regulations such as HIPAA. It also leads enterprise cryptographic modernization and post-quantum cryptography readiness, and directs Public Key Infrastructure (PKI) and machine identity security. The role combines technical expertise, healthcare application security knowledge, and team leadership to strengthen the hospital’s cybersecurity posture while balancing security, clinical operations, workforce needs, and regulatory requirements.

Requirements

At least 7 years of progressive experience in identity and access management, cybersecurity, information security, or related technology disciplines.
At least 3 years of management experience, including responsibility for technical teams.
Bachelor’s degree in cybersecurity, IT, or a related field, or an equivalent combination of education and years of experience.
Extensive expertise in enterprise IAM frameworks and technologies, including identity governance and lifecycle management, authentication, authorization, privileged access management, SAML, OAuth, OpenID Connect, and passkeys or passwordless authentication.
Ability to lead and modernize complex enterprise IAM initiatives and implement scalable strategies aligned with cybersecurity priorities, regulatory requirements, and organizational risk.
Strong proficiency with identity and privileged access platforms such as CyberArk, Ping Identity, Microsoft Active Directory, Microsoft Entra ID, and Venafi, including machine identity and certificate lifecycle management.
In-depth knowledge of healthcare cybersecurity requirements, including HIPAA, privacy regulations, and security demands of electronic health records and clinical systems.
Proficiency applying recognized cybersecurity frameworks and standards such as the NIST Cybersecurity Framework, CIS Controls, and ISO 27001.
Strong analytical and risk management skills, including the ability to assess access issues and the intersection of risk, technical architecture, and operational impacts, and to make independent risk-based decisions.
Demonstrated ability to lead specialized technical teams, manage budgets, develop talent, and optimize IAM service delivery.
Outstanding communication and executive influence skills, including translating complex cybersecurity challenges into actionable insights and fostering consensus across stakeholders.
Ability to influence change across organizational boundaries while considering workforce and operational needs.

Nice To Haves

Certified Information Systems Security Professional (CISSP).
Certified Identity and Access Manager (CIAM).
Certified Cloud Security Professional (CCSP).
Certified Enterprise Architect.
Certified Information Systems Auditor (CISA).
GIAC Security Expert (GSE).
Security+ or another cybersecurity-related certification.

Responsibilities

Provide strategic and operational leadership for the enterprise IAM program, overseeing the Identity Engineering and Epic Security teams.
Develop and execute a multi-year IAM strategy and roadmap aligned with organizational priorities, cybersecurity standards, clinical operations, technology architecture, and regulatory requirements.
Lead specialized technical teams through priority setting, workforce planning, recruitment, performance management, professional development, and accountability for project delivery.
Oversee the design, implementation, integration, and operation of identity lifecycle management, authentication, single sign-on, multifactor authentication, role-based access control, access certification, and privileged access capabilities.
Govern Epic Security, including role and template design, access provisioning, segregation of duties, access reviews, and alignment of access with clinical and operational responsibilities.
Establish identity lifecycle processes for joiner, mover, and leaver activities; workforce and non-workforce identities; role and entitlement management; provisioning and deprovisioning; and timely removal of inappropriate access.
Lead enterprise cryptographic modernization and post-quantum cryptography readiness by assessing risks, planning transitions, setting technology standards, and implementing quantum-resistant capabilities.
Direct enterprise PKI and machine identity security, including certificate discovery, issuance, renewal, policy enforcement, automation, and prevention of service interruptions.
Ensure IAM and Epic Security controls comply with legal, regulatory, and organizational requirements, including HIPAA, privacy policies, audit standards, and recognized cybersecurity frameworks.
Oversee risk-based governance processes, including access reviews, segregation-of-duties analyses, dormant-account management, and remediation of unauthorized access or control weaknesses.
Promote enterprise-wide adoption of IAM standards and controls by collaborating across departments and using risk-based decisions to address competing priorities.
Monitor emerging identity threats, authentication methods, cryptographic developments, and regulatory expectations, and incorporate significant advancements into IAM strategies and investment roadmaps.
Manage budgets and support talent development and optimized IAM service delivery.