Lead Workforce IAM Governance Specialist

M&T Bank; United States; Hybrid; USD 110,000 - 150,000; Full time

Job summary

M&T Bank is seeking an IAM Governance Lead to guide the development, governance, and modernization of workforce identity and access management policies and controls. The role partners with Cybersecurity, Technology, Risk, and Compliance to advance strategy and regulatory compliance while driving process maturity and control effectiveness.

Four days onsite at Seneca One Buffalo, NY with one day per week remote, and collaboration with executive leadership to deliver risk-based governance programs

Qualifications

• Bachelor's degree and a minimum of 5 years' relevant work experience, or in lieu of a degree, a combined minimum of 9 years' higher education and/or work experience including with Cybersecurity or Technology teams.
• Advanced knowledge of IAM principles and compliance requirements is expected.
• Experience with IAM platforms such as SailPoint, CyberArk, Microsoft Entra ID (Azure AD), Saviynt, Okta or similar systems is preferred.

Responsibilities

• Lead development and maintenance of enterprise IAM governance frameworks, policies, standards, and procedures.
• Drive IAM strategy, governance models, and operating procedures with Cybersecurity leadership and business stakeholders.
• Evaluate emerging IAM technologies and regulatory requirements to define strategic roadmap priorities.
• Design and oversee IAM governance reporting, metrics, dashboards, and risk-based monitoring.
• Prepare risk assessments and executive reporting for governance committees.
• Act as primary IAM governance partner across Cybersecurity, Risk, Compliance, Internal Audit, and business leadership.
• Lead IAM-related audits and regulatory engagements and coordinate evidence collection and remediation.

Skills

IAM governance

Regulatory compliance

Stakeholder management

Audit coordination

Education

Bachelor's degree

Job description

This role is four days onsite at our Seneca One Buffalo, NY location, with the flexibility to work from home one day per week

Overview

Responsible for leading the development, governance, and continuous improvement of Workforce Identity and Access Management (IAM) policies, standards, processes, and controls. Serves as a subject matter expert and strategic partner responsible for advancing IAM governance, regulatory compliance, and modernization initiatives that enhance the organization's security, resiliency, and operational effectiveness.

Primary Responsibilities

• Lead development and maintenance of enterprise IAM governance frameworks, policies, standards, and procedures to ensure consistent monitoring, control effectiveness, and protection of workforce identities.
• Drive the development and evolution of IAM strategy, governance models, policies, and operating procedures in partnership with Cybersecurity leadership, Technology, Risk, and business stakeholders.
• Evaluate emerging IAM technologies, industry best practices, and regulatory requirements to define strategic recommendations and roadmap priorities for IAM governance and modernization initiatives.
• Design, implement, and oversee IAM governance reporting, metrics, dashboards, and monitoring capabilities to measure risk, compliance, control effectiveness, and operational performance.
• Prepare and present risk assessments, governance insights, executive reporting, and strategic recommendations to Cybersecurity leadership and governance committees.
• Serve as the primary IAM governance partner across Cybersecurity, Technology, Risk Management, Internal Audit, Compliance, and business leadership teams to proactively identify and mitigate risk.
• Lead IAM-related audit and regulatory engagements, including coordination of evidence collection, documentation reviews, management responses, issue remediation, and control enhancement activities.
• Partner with Cybersecurity teams and managers to continuously improve process documentation, governance reporting, performance metrics, and operational maturity.
• Create and oversee remediation plans, monitor execution against milestones, and provide guidance to stakeholders to ensure timely and effective resolution of identified risks and control gaps.
• Foster strong partnerships with stakeholders across the organization to ensure successful implementation and adoption of IAM governance processes and controls.
• Lead strategic IAM initiatives and modernization efforts, including identity lifecycle management, access certification, role-based access control (RBAC), privileged access governance, segregation of duties, and policy exception management.
• Provide thought leadership, mentorship, and guidance to analysts and project teams while promoting IAM best practices and governance standards across the organization.
• Understand and adhere to the Company's risk and regulatory standards, policies, and controls in accordance with the Company's Risk Appetite. Design, implement, maintain, and enhance internal controls to mitigate risk on an ongoing basis. Identify risk-related issues requiring escalation to management.
• Promote an environment that supports belonging and reflects the M&T Bank brand.
• Maintain M&T internal control standards, including timely implementation of internal and external audit findings, as well as any issues raised by external regulators as applicable.
• Complete other related duties as assigned.

Scope of Responsibilities

Partners with Cybersecurity leadership, Technology leadership, Risk Management, Compliance, Internal Audit, external auditors, and business stakeholders across the enterprise.

Functions as a recognized IAM subject matter expert, exercising significant independent judgment in determining objectives, approaches, and solutions for complex identity governance, compliance, and risk management challenges. Work is accomplished with limited direction.

Serves as a key advisor and escalation point for Workforce IAM governance matters, influencing strategic decisions and driving execution of enterprise IAM initiatives.

Demonstrates advanced knowledge across identity governance, access management, privileged access management (PAM), cloud identity, regulatory compliance, and related cybersecurity disciplines.

Manager Responsibilities

No supervisory responsibilities.

Education and Experience Required

Bachelor's degree and a minimum of 5 years' relevant work experience, or in lieu of a degree, a combined minimum of 9 years' higher education and/or work experience inclusive of a minimum 4 years' work experience in/with the specific Cybersecurity or Technology area and/or team

Demonstrated advanced knowledge of IAM principles and compliance requirements.

Education and Experience Preferred

Advanced knowledge of SailPoint, CyberArk, Microsoft Entra ID (Azure AD), Saviynt, Okta, or comparable IAM and Privileged Access Management platforms.

Experience leading IAM transformation, modernization, cloud identit