Senior Director - Cybersecurity Identity & Access Management

McKesson•Richmond, VA

26d•$174,800 - $291,300

About The Position

The Senior Director of Identity & Access Management (IAM) is a core cybersecurity executive responsible for defining the enterprise identity vision and strategic architecture. The role recruits, empowers, and leads a high-performing organization of security engineers and practice leaders delivering resilient enterprise identity services, capabilities, and governance models. Reporting directly to the Chief Information Security Officer (CISO), the position champions the IAM vision and multi-year roadmap, drives operational excellence and risk reporting, and embeds zero-trust identity controls across business domains. The Senior Director partners with cross-functional leaders, supports onboarding to enterprise-approved identity platforms, and communicates risk posture and program progress to executive stakeholders. The role oversees a broad portfolio of IAM capabilities, including SSO, MFA, credential vaulting, identity governance, privileged access management, secrets management, lifecycle management, access certifications, threat detection, third-party governance, and customer IAM. It also leads cloud and federated identity architecture, non-human identity governance, identity threat detection and response, access governance, and identity integration strategies for mergers, acquisitions, and divestitures. The position uses automation, AI, and machine learning to improve operational efficiency, lifecycle governance, provisioning, and threat detection. The position typically requires 15 or more years of professional experience and 10 or more years of leadership experience, or equivalent experience. A bachelor's degree in computer science, information security/assurance, engineering, or a related field is specified; an advanced degree or equivalent experience is preferred. Relevant security certifications are preferred.

Requirements

Degree or equivalent experience; typically 15+ years of professional experience and 10+ years of diversified leadership, planning, communication, organization, and people-motivation skills, or equivalent experience.
15+ years of cybersecurity experience with significant depth in IAM, engineering and architecture, risk management, compliance, technology, and cybersecurity, including 10+ years leading teams and/or enterprise programs.
Hands-on and leadership experience managing and building an IAM program.
Ability to drive remediation outcomes at scale by establishing SLAs, clarifying ownership, prioritizing backlogs, and closing systemic gaps identified through incidents, hunts, and assessments.
Executive-ready communication and stakeholder-management skills, including presenting risk, progress, and investment needs to senior leadership and influencing decisions.
Demonstrated ability to set strategy, secure organizational alignment and approvals, and deliver outcomes through Security, Infrastructure, Cloud, Application/Product, and business stakeholders.
Deep understanding of cybersecurity IAM, engineering, risk management, compliance, and architecture.
Ability to translate detection gaps and remediation tradeoffs into business impact, present to executives, and drive decisions to closure.
Experience establishing oversight metrics and operational rhythms, such as OKRs/KPIs, reporting, and service reviews, and using data to improve alert quality, reduce noise, and accelerate remediation.
Working knowledge of governance and regulatory expectations, and ability to partner with audit, compliance, and privacy stakeholders while operating a detection and response capability.
Track record of building high-performing teams and leading with integrity, accountability, and operational discipline, with clear communication, sound judgment, and reliable execution.
Experience developing multi-year roadmaps and influencing investment decisions involving people, tooling, telemetry, and automation.
Experience managing vendor relationships and security-tooling and managed-service contracts, including defining requirements and measuring outcomes.
Understanding of privacy considerations and appropriate monitoring practices; ability to partner with Legal/Privacy and HR and keep monitoring and investigations within policy and regulatory boundaries.
Experience operating in hybrid/cloud environments and partnering with platform teams to instrument systems using cloud logging, identity signals, endpoint telemetry, and network data.
Strong strategic and tactical decision-making, including balancing speed and risk, defining compensating controls, and driving complex remediation decisions across owners.
Experience leading or sponsoring purple-team activities, tabletop exercises, and control validation to improve detection coverage and response playbooks.
Bachelor's degree in computer science, information security/assurance, engineering, or a related field, or equivalent experience.

Nice To Haves

Advanced degree.
Relevant certifications such as CISSP, CISM, GIAC/SANS, CompTIA Security+, SSCP, or equivalent foundational security certification.
TDR/SecOps certifications, including Google Cloud Professional Cloud Security Engineer, Associate Cloud Engineer, Google Professional Cloud DevOps Engineer, or GIAC certifications such as GSEC or GCIH, depending on role focus.
Cloud or security engineering certifications aligned to the teams' platforms.

Responsibilities

Establish and own the enterprise IAM vision, multi-year strategy, roadmap, and operating model; hire and manage the IAM organization.
Implement and oversee IAM capabilities, including SSO, MFA, credential vaulting, identity governance, privileged access management, secrets management, lifecycle management, access certifications, threat detection, third-party governance, and CIAM.
Design identity solutions for complex or non-standard deployment scenarios that cannot use core IAM services directly.
Oversee identity governance, define and monitor performance metrics, and partner with business teams to remediate non-compliance.
Build industry relationships to support adoption of current technologies and best practices.
Develop cybersecurity metrics and executive reporting processes, including KPIs.
Partner with technology and application teams to onboard applications to enterprise-approved identity products and services, including as part of cloud migration efforts.
Partner with risk management and compliance stakeholders to maintain regulatory alignment.
Establish non-human identity governance and secrets-management controls, including machine identity lifecycle management, service-account rotation, and API credential security across multi-cloud environments.
Partner with the Threat Detection and Response leader to implement ITDR capabilities that monitor, detect, and remediate anomalous access behavior, credential misuse, and identity-based vulnerabilities.
Drive cross-functional access governance across business, HR, and technology teams to enforce least privilege, RBAC, and automated joiner-mover-leaver workflows.
Architect resilient cloud and federated identity models across multi-cloud and hybrid infrastructures, standardizing SSO, MFA, and zero-trust conditional access policies.
Lead M&A identity integration and divestiture strategies, including identity carve-outs, directory consolidations, and federation separation.
Architect and deliver scalable, fault-tolerant, highly available enterprise identity products and services.
Use automation, AI, and machine learning to improve operational efficiency, lifecycle governance, user provisioning, and proactive identity threat detection.