Lead Workforce IAM Governance Specialist

M&T Bank; Buffalo (NY); Hybrid; USD 116,000 - 194,000; Full time

Job summary

M&T Bank is seeking a senior IAM Governance lead to drive enterprise IAM policies, standards, and controls. You will partner with Cybersecurity, Risk, Audit, and business leaders to advance governance, modernization, and regulatory compliance across the organization.

The role requires expertise in identity governance, RBAC, access certification, PAM, and regulatory frameworks such as SOX, NIST, and ISO 27001. Location is Buffalo with hybrid onsite/remote flexibility.

Qualifications

• Bachelor's degree and at least 5 years' IAM experience or equivalent.
• Strong knowledge of IAM principles and compliance requirements.
• Ability to translate regulatory requirements into governance processes.

Responsibilities

• Lead IAM governance frameworks, policies, and procedures.
• Develop IAM strategy and operating procedures with stakeholders.
• Evaluate IAM technologies and regulatory requirements to define roadmap.
• Design and oversee IAM governance reporting and dashboards.
• Lead IAM-related audit engagements and remediation activities.
• Collaborate across Cybersecurity, Risk, Audit, Compliance.

Skills

IAM governance

Regulatory compliance

Risk management

Stakeholder management

Leadership without authority

Education

Bachelor's degree or equivalent

Advanced degree preferred

Tools

SailPoint

CyberArk

Microsoft Entra ID (Azure AD)

Saviynt

Okta

Job description

This role is four days onsite at our Seneca One Buffalo, NY location, with the flexibility to work from home one day per week

Overview

Responsible for leading the development, governance, and continuous improvement of Workforce Identity and Access Management (IAM) policies, standards, processes, and controls. Serves as a subject matter expert and strategic partner responsible for advancing IAM governance, regulatory compliance, and modernization initiatives that enhance the organization's security, resiliency, and operational effectiveness.

Primary Responsibilities

• Lead development and maintenance of enterprise IAM governance frameworks, policies, standards, and procedures to ensure consistent monitoring, control effectiveness, and protection of workforce identities.
• Drive the development and evolution of IAM strategy, governance models, policies, and operating procedures in partnership with Cybersecurity leadership, Technology, Risk, and business stakeholders.
• Evaluate emerging IAM technologies, industry best practices, and regulatory requirements to define strategic recommendations and roadmap priorities for IAM governance and modernization initiatives.
• Design, implement, and oversee IAM governance reporting, metrics, dashboards, and monitoring capabilities to measure risk, compliance, control effectiveness, and operational performance.
• Prepare and present risk assessments, governance insights, executive reporting, and strategic recommendations to Cybersecurity leadership and governance committees.
• Serve as the primary IAM governance partner across Cybersecurity, Technology, Risk Management, Internal Audit, Compliance, and business leadership teams to proactively identify and mitigate risk.
• Lead IAM-related audit and regulatory engagements, including coordination of evidence collection, documentation reviews, management responses, issue remediation, and control enhancement activities.
• Partner with Cybersecurity teams and managers to continuously improve process documentation, governance reporting, performance metrics, and operational maturity.
• Create and oversee remediation plans, monitor execution against milestones, and provide guidance to stakeholders to ensure timely and effective resolution of identified risks and control gaps.
• Foster strong partnerships with stakeholders across the organization to ensure successful implementation and adoption of IAM governance processes and controls.
• Lead strategic IAM initiatives and modernization efforts, including identity lifecycle management, access certification, role-based access control (RBAC), privileged access governance, segregation of duties, and policy exception management.
• Provide thought leadership, mentorship, and guidance to analysts and project teams while promoting IAM best practices and governance standards across the organization.
• Understand and adhere to the Company's risk and regulatory standards, policies, and controls in accordance with the Company's Risk Appetite. Design, implement, maintain, and enhance internal controls to mitigate risk on an ongoing basis. Identify risk-related issues requiring escalation to management.
• Promote an environment that supports belonging and reflects the M&T Bank brand.
• Maintain M&T internal control standards, including timely implementation of internal and external audit findings, as well as any issues raised by external regulators as applicable.
• Complete other related duties as assigned.

Scope of Responsibilities

• Partners with Cybersecurity leadership, Technology leadership, Risk Management, Compliance, Internal Audit, external auditors, and business stakeholders across the enterprise.
• Functions as a recognized IAM subject matter expert, exercising significant independent judgment in determining objectives, approaches, and solutions for complex identity governance, compliance, and risk management challenges. Work is accomplished with limited direction.
• Serves as a key advisor and escalation point for Workforce IAM governance matters, influencing strategic decisions and driving execution of enterprise IAM initiatives.
• Demonstrates advanced knowledge across identity governance, access management, privileged access management (PAM), cloud identity, regulatory compliance, and related cybersecurity disciplines.

Manager Responsibilities

No supervisory responsibilities.

Education and Experience Required

• Bachelor's degree and a minimum of 5 years’ relevant work experience, or in lieu of a degree, a combined minimum of 9 years’ higher education and/or work experience inclusive of a minimum 4 years’ work experience in/with the specific Cybersecurity or Technology area and/or team
• Demonstrated advanced knowledge of IAM principles and compliance requirements.

Education and Experience Preferred

• Advanced knowledge of SailPoint, CyberArk, Microsoft Entra ID (Azure AD), Saviynt, Okta, or comparable IAM and Privileged Access Management platforms.
• Experience leading IAM transformation, modernization, cloud identity, or enterprise governance initiatives.
• Expertise in identity lifecycle management, access provisioning, access certifications, role management, privileged access governance, and access control frameworks.
• Experience establishing enterprise IAM governance frameworks, policies, standards, and control procedures.
• Strong knowledge of regulatory and compliance frameworks, including SOX, FFIEC, NIST, ISO 27001, and related banking regulatory requirements.
• Proven experience developing IAM roadmaps, strategic planning efforts, and tooling transformation initiatives.
• Ability to influence senior leaders and drive cross-functional initiatives without direct authority.
• Demonstrated advanced knowledge of technology risk management principles and compliance requirements.
• Excellent written, verbal, presentation, and stakeholder management skills.
• Strong critical thinking, analytical, and problem-solving skills with the ability to lead resolution of complex governance and risk-related challenges.
• Proven experience translating technical and regulatory requirements into scalable governance processes, policies, and standards.

M&T Bank is committed to fair, competitive, and market-informed pay for our employees. The pay range for this position is $116,400.00 - $194,000.00 Annual (USD). The successful candidate’s particular combination of knowledge, skills, and experience will inform their specific compensation.

Location

Buffalo, New York, United States of America