IAM Governance Lead — Passwordless & Privileged Access

Nexthink; Madrid; Hybrid; EUR 120,000 - 150,000; Full time

Benefits offered by this job

Permanent Contract

Hybrid work model

Health Insurance (Sanitas)

Meal vouchers 11 EUR

Unlimited vacation

Job summary

Nexthink is a leader in digital employee experience management software seeking an IAM and Access Control Lead to drive identity strategy and operational excellence across Nexthink's corporate perimeter.

You will lead a small team of senior engineers responsible for the platforms, policies and engineering standards that govern how every employee, contractor, service account and non-human identity gains, uses, and loses access across Nexthink's corporate environment.

Qualifications

• 8+ years in identity and access management, including 2+ years leading IAM governance, strategy, or a senior technical IAM function.
• Demonstrable track record designing and operating access governance - access reviews/certification, RBAC models, and entitlement rationalisation at enterprise scale.
• Hands-on experience with Segregation of Duties and access governance over business applications such as Workday, NetSuite, or Salesforce.
• Operational expertise in Microsoft Entra ID and Okta - Conditional Access, federation, SCIM, OIDC/SAML.
• Experience with privileged access tooling (Entra PIM, Okta privileged access, JIT admin) and a record of reducing standing admin and orphaned accounts.
• Experience with non-human identity governance - service accounts, OAuth apps, secrets management.
• Compliance and audit fluency: ISO 27001, SOC 2, or SOX - able to design controls and produce audit-ready evidence.
• Ability to communicate governance and technical decisions clearly to senior business stakeholders, Finance, and Internal Audit. Fluent English.

Responsibilities

• Define and own the IAM governance model—principles, standards, decision rights, and operating cadence.
• Develop and maintain the multi-year IAM roadmap, sequencing capability build against business risk.
• Establish the application prioritization and SaaS onboarding strategy with timelines.
• Define RBAC governance standards and target access model across the corporate estate.
• Scope, commission, and steer external engagements while retaining internal ownership.
• Design and operate the enterprise access review and certification framework.
• Run recurring access certifications with audit-ready evidence trails.
• Establish and operate quarterly privileged access reviews; drive standing admin toward zero.

Skills

IAM governance

RBAC models

Entra ID

Okta

SAML/OIDC

PIM / privileged access

Non-human identity

SOX / ISO 27001 / SOC 2

Stakeholder communication

Audit readiness

Tools

Workday

NetSuite

Salesforce

Microsoft Entra ID

Okta

SCIM

SAML

Job description

Nexthink is a leader in digital employee experience management software seeking an IAM and Access Control Lead to drive identity strategy and operational excellence across Nexthink's corporate perimeter.

You will lead a small team of senior engineers responsible for the platforms, policies and engineering standards that govern how every employee, contractor, service account and non-human identity gains, uses, and loses access across Nexthink's corporate environment.