Manager, Identity and Access Management (IAM)

Tampa General Hospital•Tampa, FL

About The Position

The Manager, Identity and Access Management (IAM) is a cybersecurity leadership role at Tampa General Hospital, responsible for the enterprise IAM program and two teams: Identity Engineering and Epic Security. The manager safeguards access to enterprise systems, sensitive information, the electronic health record, and clinical applications while balancing security, clinical operations, workforce experience, and regulatory requirements. The role leads the design, implementation, integration, and operation of identity capabilities, including identity lifecycle management, authentication, single sign-on, multifactor authentication, role-based access control, access certification, privileged access, directories, certificates, and machine identities. It advances modern authentication and identity security, including passwordless access, federation, and conditional access, using platforms such as Ping Identity, CyberArk, Venafi, Microsoft Entra ID, and Active Directory. The manager provides governance for Epic Security, ensuring access aligns with workforce roles, least-privilege principles, clinical and operational responsibilities, and regulatory requirements. This includes role and template design, provisioning, access changes, segregation-of-duties controls, privileged access oversight, and periodic access reviews with clinical and operational stakeholders. The position develops and executes a multi-year IAM strategy and roadmap; establishes technical standards and lifecycle processes; leads cryptographic modernization and post-quantum readiness; and directs PKI and machine identity security. It also ensures compliance with HIPAA, privacy policies, audit standards, and recognized cybersecurity frameworks, and works across departments to address operational, clinical, technology, and workforce priorities through risk-based decisions.

Requirements

Bachelor’s degree in Cybersecurity, IT, or a related field, or an equivalent combination of education and years of experience.
At least 7 years of progressive experience in identity and access management, cybersecurity, information security, or related technology disciplines.
At least 3 years of management experience, including responsibility for technical teams.
Extensive expertise in enterprise IAM frameworks and technologies, including identity governance, lifecycle management, authentication, authorization, privileged access management, and protocols such as SAML, OAuth, OpenID Connect, and passkeys or passwordless authentication.
Ability to lead and modernize complex enterprise IAM initiatives and implement scalable strategies aligned with cybersecurity priorities, regulatory requirements, and organizational risk.
Proficiency with identity and privileged access management platforms such as CyberArk, Ping Identity, Microsoft Active Directory, Microsoft Entra ID, and Venafi, including machine identity and certificate lifecycle management.
Knowledge of healthcare cybersecurity requirements, including HIPAA, privacy regulations, and security requirements for EHR and clinical systems.
Proficiency applying cybersecurity frameworks and standards such as the NIST Cybersecurity Framework, CIS Controls, and ISO 27001 to IAM policies, procedures, and technical patterns.
Strong analytical and risk-management skills, including the ability to assess access issues and make independent risk-based decisions considering technical architecture and operational impacts.
Leadership capabilities in guiding technical teams, managing budgets, developing talent, optimizing IAM service delivery, and influencing organizational change.
Strong communication and executive influence skills, including the ability to explain complex identity and cybersecurity issues to diverse stakeholders, build consensus, and advance IAM practices.

Nice To Haves

Certified Information Systems Security Professional (CISSP).
Certified Identity and Access Manager (CIAM).
Certified Cloud Security Professional (CCSP).
Certified Enterprise Architect.
CISA: Certified Information Systems Auditor.
GSE: GIAC Security Expert.
Security+ certification.
Other cybersecurity-related certification.

Responsibilities

Provide strategic and operational leadership for the enterprise IAM program, overseeing the Identity Engineering and Epic Security teams.
Develop and execute a multi-year IAM strategy and roadmap aligned with organizational priorities, cybersecurity standards, clinical operations, technology architecture, and regulatory requirements.
Lead technical teams by setting priorities, planning workforce needs, recruiting, managing performance, supporting professional development, and ensuring accountability for project delivery.
Oversee the design, implementation, integration, and operation of identity lifecycle management, authentication, single sign-on, multifactor authentication, role-based access control, access certification, and privileged access capabilities.
Govern Epic Security, including role and template design, access provisioning, segregation of duties, access reviews, and alignment of access with clinical and operational responsibilities.
Establish identity lifecycle processes for joiner, mover, and leaver activities; workforce and non-workforce identities; role and entitlement management; provisioning and deprovisioning; and timely removal of inappropriate access.
Lead enterprise cryptographic modernization and post-quantum cryptography readiness by assessing risks, planning transitions, setting technology standards, and implementing quantum-resistant capabilities.
Direct enterprise PKI and machine identity security, including certificate discovery, issuance, renewal, policy enforcement, automation, and prevention of service interruptions.
Ensure IAM and Epic Security controls comply with legal, regulatory, and organizational requirements, including HIPAA, privacy policies, audit standards, and cybersecurity frameworks.
Oversee risk-based governance, including access reviews, segregation-of-duties analyses, dormant-account management, and remediation of unauthorized access or control weaknesses.
Collaborate across departments to promote IAM standards and controls and resolve competing operational, clinical, technology, and workforce priorities through risk-based decision-making.
Monitor identity threats, authentication methods, cryptographic developments, and regulatory expectations, incorporating significant developments into IAM strategies and investment roadmaps.