Senior Director - Cybersecurity Identity & Access Management

McKesson • Richmond, VA

13d

About The Position

The Senior Director of Identity & Access Management (IAM) serves as a core cybersecurity executive, defining the enterprise identity vision and strategic architecture. Reporting directly to the Chief Information Security Officer (CISO), this leader recruits, empowers, and leads security engineers and practice leaders who deliver resilient, enterprise-wide identity services, capabilities, and governance models. The role requires deep expertise in identity control frameworks and modern access management architectures.

The Senior Director champions the IAM vision and multi-year roadmap, drives operational excellence and risk reporting, and embeds zero-trust identity controls across business domains. The role partners with cross-functional leaders to onboard products to enterprise-approved identity platforms and communicates risk posture and program progress to executive stakeholders. It also leads identity governance and access capabilities across cloud, hybrid, and multi-cloud environments, with a focus on scalability, resilience, automation, and continuous improvement.

The position is within McKesson Medical-Surgical (MMS), a McKesson Corporation subsidiary and publicly reported segment. MMS distributes medical-surgical supplies, pharmaceuticals, diagnostic equipment and supplies, and related solutions to healthcare settings outside traditional hospitals. MMS has approximately 8,000 employees, 15 distribution centers, approximately 900 delivery vehicles, more than 2,200 manufacturer partners, and over 200,000 customer accounts. MMS is expected to become Wellverse in early 2027.

Requirements

• At least 15 years of professional experience, typically with at least 10 years of diversified leadership, planning, communication, organization, and people-motivation skills, or equivalent experience.
• 15+ years of cybersecurity experience with significant depth in IAM, engineering and architecture, risk management, compliance, technology, and cybersecurity; 10+ years leading teams and/or enterprise programs.
• Hands-on and leadership experience managing and building an IAM program.
• Ability to drive remediation outcomes at scale by establishing SLAs, clarifying ownership, prioritizing backlogs, and closing systemic gaps identified through incidents, hunts, and assessments.
• Executive-ready communication and stakeholder-management skills, including presenting risk, progress, and investment needs to senior leaders and influencing decisions.
• Ability to set strategy, secure organizational alignment and approvals, and deliver outcomes through Security, Infrastructure, Cloud, Application/Product, and business stakeholders.
• Deep understanding of cybersecurity IAM, engineering, risk management, compliance, and architecture.
• Ability to translate detection gaps and remediation tradeoffs into business impact, present to executives, and drive decisions to closure.
• Experience establishing oversight metrics and operational rhythms, including OKRs/KPIs, reporting, and service reviews, and using data to improve alert quality, reduce noise, and accelerate remediation.
• Working knowledge of relevant governance and regulatory expectations, and ability to partner with audit, compliance, and privacy stakeholders while operating a detection and response capability.
• Track record of building high-performing teams and leading with integrity, accountability, and operational discipline, with clear communication, sound judgment, and reliable execution.
• Experience developing multi-year roadmaps and influencing investment decisions to improve enterprise detection and remediation outcomes.
• Experience managing vendor relationships and service contracts for security tooling and managed services, including defining requirements and measuring performance.
• Understanding of privacy considerations and appropriate monitoring practices, with the ability to partner with Legal/Privacy and HR and ensure monitoring and investigations stay within policy and regulatory boundaries.
• Experience operating in hybrid and cloud environments and partnering with platform teams to instrument systems with cloud logging, identity signals, endpoint telemetry, and network data.
• Strategic and tactical decision-making ability, including balancing speed and risk, defining compensating controls, and driving complex remediation decisions across multiple owners.
• Experience leading or sponsoring purple-team activities, tabletop exercises, and control validation to improve detection coverage and response playbooks.
• Bachelor’s degree in computer science, information security/assurance, engineering, or a related field, or equivalent experience.

Nice To Haves

• Advanced degree.
• Relevant certifications such as CISSP, CISM, GIAC/SANS, Security+, SSCP, or equivalent foundational security certification.
• TDR/SecOps certifications such as Google Cloud Professional Cloud Security Engineer, Associate Cloud Engineer, Google Professional Cloud DevOps Engineer, and/or GIAC certifications (for example, GSEC or GCIH), depending on role focus.
• Cloud or security engineering certifications aligned to the teams’ platforms.

Responsibilities

• Establish and own the enterprise IAM vision, multi-year strategy, roadmap, and operating model; hire and manage the IAM organization.
• Implement and oversee IAM capabilities, including SSO, MFA, credential vaulting, identity governance, privileged access management, secrets management, lifecycle management, access certifications, threat detection, third-party governance, and CIAM.
• Design tailored identity solutions for complex or non-standard deployment scenarios.
• Oversee identity governance, define and meet performance metrics, and partner with business teams to remediate non-compliance.
• Build industry relationships to support adoption of current technology and best practices.
• Develop and lead cybersecurity metrics and executive reporting, including KPIs.
• Partner with technology and application teams to onboard applications to approved identity products and services, including during enterprise cloud migrations.
• Partner with risk management and compliance stakeholders to maintain regulatory alignment.
• Establish non-human identity governance and secrets management controls, including machine identity lifecycle management, service account rotation, and API credential security across multi-cloud environments.
• Partner with the Threat Detection and Response leader to implement identity threat detection and response capabilities that monitor, detect, and remediate anomalous access, credential misuse, and identity vulnerabilities.
• Drive cross-functional access governance with business, HR, and technology teams to enforce least privilege, RBAC, and automated joiner-mover-leaver workflows.
• Architect resilient cloud and federated identity models across multi-cloud and hybrid environments, including Azure/Entra ID, GCP, and Okta, and standardize SSO, MFA, and zero-trust conditional access policies.
• Lead M&A identity integration and divestiture strategies, including identity carve-outs, directory consolidations, and federation separation.
• Architect and deliver scalable, fault-tolerant, highly available enterprise identity products and services.
• Use automation, AI, and ML to improve operational efficiency, automate lifecycle governance and provisioning, and enhance proactive identity threat detection.
• Drive remediation outcomes at scale by establishing SLAs, clarifying ownership, prioritizing backlogs, and closing systemic gaps.
• Establish oversight metrics and operational rhythms, such as OKRs/KPIs, reporting, and service reviews, and use data to improve alert quality and remediation throughput.
• Develop multi-year roadmaps and influence investment decisions involving people, tooling, telemetry, and automation.
• Manage vendor relationships and security-tooling or managed-services contracts, defining requirements and measuring performance against outcomes.
• Partner with Legal, Privacy, and HR as needed to ensure monitoring and investigations comply with policy and regulatory boundaries.
• Partner with platform teams to instrument hybrid and cloud environments with logging, identity signals, endpoint telemetry, and network data for reliable detections.
• Lead or sponsor purple-team activities, tabletop exercises, and control validation to improve detection coverage and response playbooks.

Benefits

• Competitive compensation package.
• Annual bonus or long-term incentive opportunities may be offered.
• Benefits are available; details are provided through McKesson’s benefits information.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior