Information Security Risk Analyst II

CardWorks Servicing LLC; Town of Woodbury (NY); Hybrid; USD 89,000 - 98,000; Full time

Benefits offered by this job

Bonus target

Medical, Dental, Vision

401(k) Match

Disability benefits

Wellness programs

Paid vacation and holidays

Job summary

CardWorks Financial Group is seeking an IAM Analyst II to manage detective IAM controls and support User Access Reviews across the enterprise. You will validate data, coordinate reviewer participation, and help ensure evidence retention and remediation tracking.

The role requires collaboration with IAM engineering, cybersecurity, risk management, and audit teams to improve control effectiveness and automate recurring processes. Hybrid/remote options may be considered.

Qualifications

• Bachelor's degree in Information Security, Information Technology, Computer Science, Business, or a related discipline; or an equivalent combination of education and relevant experience.
• 3+ years of experience in Identity and Access Management, information security, IT risk, IT controls, or a related technology function.
• 3+ years of experience with SailPoint is required.
• 1+ years of experience with Delinea preferred.
• Experience supporting or executing User Access Reviews, access certifications, access reconciliations, or similar identity and access controls preferred.

Responsibilities

• Facilitate IAM detective controls with a primary focus on User Access Reviews and access certification activities.
• Coordinate end-to-end execution of UARs, including preparation, initiation, reviewer engagement, completion tracking, validation, and evidence retention.
• Perform completeness and accuracy procedures for access review populations and supporting data.
• Review control results to identify access exceptions, violations, or remediation needs.
• Support additional detective IAM controls, including access reconciliations, authentication reviews, and privileged access reviews.
• Maintain documentation and evidence demonstrating control execution and completion.
• Escalate issues and risks to IAM management as needed.
• Assist with automation of data collection, validation, reconciliation, reporting, and workflows.
• Partner with IAM engineering and platform teams to improve data, integrations, and automation.

Skills

IAM concepts

User Access Reviews

Access governance

Data analysis

Audit readiness

Education

Bachelor's degree in Information Security or related field

Tools

SailPoint

Delinea

Job description

About the Company

Become an everyday champion — and build a career where your impact fuels financial progress. What We Do CardWorks Financial Group is a diversified financial services platform building ethical solutions across credit, lending, and the full customer lifecycle. Through our family of companies, CardWorks Financial Group tackles the complex challenges that larger financial institutions leave behind. We’re embedded throughout the credit card ecosystem as a lender, servicer, and merchant acquirer. Who We Are Merrick Bank: The bank that builds CardWorks Servicing: One partner, total performance Carson Smithfield: Resolution with respect With nearly 40 years of operating history, our track record is solid: disciplined in downturns and built to accelerate in recovery. The CardWorks Financial Group companies take precise approach in complex markets, as a top three non-prime focused general purpose card issuer and a top fifteen U.S. merchant acquirer. Our team tackles the industry’s most complex credit and payment challenges. And we believe that excellent work starts with a team that feels supported, respected, and empowered to grow.

Role Overview

The IAM Analyst II is responsible for the execution and facilitation of Identity and Access Management (IAM) detective controls that identify unauthorized, inappropriate, or unnecessary access across the enterprise. This role has primary responsibility for supporting User Access Reviews (UARs), including review preparation, data validation, reviewer coordination, completion monitoring, exception management, evidence retention, and remediation tracking. In addition to access certifications, the IAM Analyst II supports other detective IAM controls and monitoring activities, including access reconciliations, authentication and privileged access reviews, access-related monitoring, and investigation of identified exceptions. The role works closely with application owners, business stakeholders, IAM engineering, cybersecurity, risk management, and audit teams to ensure controls are executed consistently, supported by complete and accurate data, and maintained in an audit-ready state. The ideal candidate combines strong operational discipline, analytical skills, and an understanding of identity and access management concepts, with an ability to manage recurring control activities involving multiple applications and stakeholders. The role is also expected to identify opportunities to improve control effectiveness, streamline processes, and reduce manual effort through automation.

Essential Functions

• Facilitate and execute IAM detective controls, with a primary focus on User Access Reviews and access certification activities.
• Coordinate the end-to-end execution of assigned UARs, including preparation, initiation, reviewer engagement, completion tracking, validation, and evidence retention.
• Perform completeness and accuracy procedures associated with access review populations and supporting data.
• Review control results to identify access exceptions, inappropriate access, policy violations, or other conditions requiring investigation or remediation.
• Support additional detective IAM controls, including access reconciliations, authentication configuration reviews, privileged access reviews, and other access-related monitoring activities.
• Maintain accurate documentation and evidence demonstrating control execution and completion.
• Escalate control issues, missed deadlines, data quality concerns, or potentially significant access findings to IAM management.
• Assist with automation of data collection, validation, reconciliation, reporting, evidence generation, and control workflows.
• Partner with IAM engineering and platform teams to improve control data, integrations, and automation capabilities.
• Participate in testing and validation of new or enhanced IAM control capabilities.

Requirements for Success

• Education & Experience: Bachelor's degree in Information Security, Information Technology, Computer Science, Business, or a related discipline; or an equivalent combination of education and relevant experience.
• 3 plus years of experience in Identity and Access Management, information security, IT risk, IT controls, or a related technology function.
• 3 plus years of experience with SailPoint is required.
• 1 plus years of experience with Delinea preferred.
• Experience supporting or executing User Access Reviews, access certifications, access reconciliations, or similar identity and access controls preferred.
• Experience analyzing user, account, role, entitlement, or application access data.
• Experience working with business and technology stakeholders to facilitate recurring control activities or resolve access-related issues.
• Experience supporting audit, risk, or compliance activities preferred, particularly within a regulated environment.
• Familiarity with IAM, IGA, PAM, authentication, or access management technologies preferred.
• Familiarity with data analysis, reporting, scripting, workflow, or automation technologies preferred.
• Working knowledge of security and control frameworks such as SOX, SOC1, SOC2, or similar regulatory and compliance requirements preferred.

Knowledge, Skills and Capabilities

• Understanding of identity and access management concepts, including user access, entitlements, authentication, privileged access, and access governance.
• Strong organizational skills and ability to coordinate recurring control activities involving multiple applications, reviewers, and deadlines.
• Strong analytical skills with the ability to work with access data, identify discrepancies, and investigate exceptions.
• High attention to detail, particularly when performing data validation, control execution, and evidence collection.
• Ability to effectively facilitate User Access Reviews and communicate expectations to business and technology stakeholders.
• Ability to independently manage assigned control activities while appropriately escalating issues and risks.
• Strong written and verbal communication skills.
• Ability to document processes, control activities, findings, and remediation clearly and consistently.
• Ability to identify opportunities for process improvement and automation.
• Demonstrated commitment to operational discipline, control effectiveness, and secure access practices.

Location

Ideally, the qualified candidate will work at the following location(s): Woodbury, NY; Pittsburgh, PA, Orlando, Fl, South Jordan, UT. A hybrid work model or fully remote model can be considered based on hiring manager decision and priorities of the role.

Salary Range

The salary range for this position, if located in NY Metro/NY State is $88,605 to $98,450. However, please note that the salary range will vary for other geographic areas.

Employee Value Proposition

• Competitive Pay, including a Bonus Target or Variable Pay Incentive Program
• Benefits Package –Medical, Dental, and Vision (plus much more)
• 401(k) Plan with Company Match
• Short- & Long-Term Disability
• Wellness Programs
• Group Life and AD&D Insurance
• Paid Vacation, Sick Days and bank Holidays
• Employee Engagement Activities including Employee Appreciation Day, DEI Employee Resource Groups, Corporate Social Responsibility, Service Recognition

Equal Opportunity and Diversity

We are proud to be an equal opportunity employer. All qualified applicants will receive consideration without regard to age, race, color, sex, or gender identity/expression (including pregnancy, childbirth, transgender status, or sexual orientation), religion or creed, ancestry, citizenship, national origin, disability, military or veteran status, marital status, genetic information, or any other characteristic protected by applicable law. We do not tolerate discrimination, harassment, or retaliation. Employment decisions are based solely on qualifications, merit, and business needs. Everyone is welcome here, and we hire based on your ability to do the job, not any protected characteristics. If you need help or reasonable accommodation during the application or hiring process, please let your TA Partner know.

Company Vision

CardWorks Financial Group is the engine driving financial progress, a diversified consumer finance provider building ethical solutions across credit, lending, and the full customer lifecycle. Advancing finance with purpose, we put people—clients, customers, and colleagues—at the center of everything we do, guided by our CRITICAL values and united as one enterprise across Merrick Bank, CardWorks Servicing, and Carson Smithfield. As your everyday champion, our vertically integrated platform fuels financial progress through access to credit, high yield deposits, flexible merchant payments, and end to end servicing performance—powered by a culture of relentless curiosity, belonging, and growth.