Sr Identity and Access Management Analyst

CB&I; The Woodlands (TX); On-site; USD 120,000 - 160,000; Full time

Job summary

CB&I is seeking a Senior Identity and Access Management Analyst to design, implement, and operate IAM controls across enterprise systems. The role ensures proper access governance, SOX compliance, and scalable identity lifecycle management for employees, contractors, and project-based users.

You will work with Azure AD/Entra ID, Okta, SailPoint, and CyberArk, driving automation and integration with cloud and on-prem environments.

Qualifications

• Bachelor’s degree in IT, Cybersecurity, or related field.
• 10+ years of Information Technology experience.
• 5+ years IAM hands-on experience.
• Strong hands-on experience with IAM platforms (e.g., Entra ID, Okta, SailPoint).
• Scripting or automation experience (PowerShell, Python).

Responsibilities

• Serve as SME for IAM and SOX logical access controls across financial systems.
• Administer IAM-based access governance, provisioning workflows, lifecycle management, and access certifications.
• Design and maintain scalable IAM frameworks aligned to least privilege, RBAC, SoD, and SOX.
• Execute and support SOX logical access controls, including UARs and privileged access management.
• Collaborate with system owners to align access with business responsibilities.
• Remediate access risks, orphaned accounts, stale memberships, and SoD conflicts.
• Support audit readiness through documentation and evidence.
• Collaborate on IAM implementations ensuring scalable controls.
• Drive automation across IAM governance and access management.
• Manage identity lifecycle processes for employees, contractors, and project users.
• Provision and deprovision access across enterprise systems and platforms.
• Maintain identity repositories (Azure AD/Entra ID and on-prem AD).
• Perform and support user access reviews, certifications, remediation tasks.
• Implement authentication mechanisms (SSO, MFA, conditional access).
• Collaborate on IAM configuration, integrations, and enhancements (SailPoint, Okta, Entra ID, CyberArk).
• Automate provisioning workflows to improve efficiency.
• Integrate IAM controls with cloud platforms (Azure, AWS) and SaaS apps.
• Provide guidance and mentoring to IT staff and stakeholders.

Skills

IAM expertise

SOX compliance

RBAC

PAM

SailPoint/Okta

Azure Entra ID

Education

Bachelors in IT or Cybersecurity

CISSP or CISM; SC-300

Tools

SailPoint

Okta

Microsoft Entra ID

CyberArk

Job description

Overview

The Senior Identity and Access Management (IAM) Analyst is responsible for ensuring the right people securely access the right company data and systems. The incumbent will support and mature Identity and Access Management (IAM) capabilities across the enterprise by designing, implementing, and maintaining IAM‑enabled access management practices that strengthen internal controls, support audit readiness, and enable efficient, scalable business operations.

This position is an Individual Contributor role. The role directly reports to the Director of Cybersecurity and routinely interacts with Global IT, Project Management, Engineering, Legal, and Risk Management.

Responsibilities

• Serve as a subject matter expert for IAM and SOX logical access controls across financial systems.
• Administer and optimize IAM‑based access governance, including provisioning workflows, lifecycle management, group structures, and access certifications.
• Design and maintain scalable IAM frameworks aligned to least privilege, RBAC, segregation of duties (SoD), and SOX compliance requirements.
• Execute and support SOX logical access controls, including provisioning, modifications, terminations, privileged access management, and user access reviews (UARs).
• Partner with system owners and business stakeholders to validate the appropriateness and alignment of access with business responsibilities.
• Maintain strong access governance controls by proactively reviewing and remediating access risks, including excessive access, orphaned accounts, stale memberships, and SoD conflicts.
• Support audit readiness through documentation, evidence preparation, remediation tracking, and control support activities.
• Collaborate on system implementations and enhancements to ensure IAM controls are embedded, scalable, and supportable.
• Drive continuous improvement and automation opportunities across IAM governance and access management processes.
• Manage end-to-end identity lifecycle processes (joiner, mover, leaver) for employees, contractors, and project‑based users.
• Provision and deprovision access across enterprise systems, engineering applications, and project platforms (e.g., JD Edwards, Autodesk platforms).
• Maintain and support identity repositories including Microsoft Entra ID (Azure AD) and on‑premises Active Directory.
• Perform and support user access reviews, certifications, and remediation activities.
• Implement and support authentication mechanisms including SSO, MFA, and conditional access policies.
• Collaborate on IAM platform configuration, integrations, and enhancements (e.g., SailPoint, Okta, Microsoft Entra ID, CyberArk).
• Automate provisioning workflows to improve efficiency and reduce manual processes.
• Integrate IAM controls with cloud platforms (Azure, AWS) and SaaS applications, including federation and role mapping.
• Provide guidance, training, and mentoring to IT staff and business stakeholders.

Qualifications

• Bachelor’s Degree in Information Technology, Cybersecurity, or related field.
• Industry certifications such as: CISSP or CISM; Microsoft SC‑300 (Identity and Access Administrator) or other relevant IAM or security certifications.
• 10+ Years of Information Technology experience.
• 5+ years of hands‑on experience in IAM, IT security, or infrastructure roles.
• Strong hands‑on experience with enterprise IAM platforms such as Microsoft Entra ID, Okta, SailPoint, or equivalent.
• Demonstrated hands‑on experience implementing and managing authentication, authorization, and federation technologies including SSO, MFA, SAML, OAuth 2.0, OpenID Connect, and directory services such as Active Directory and LDAP.
• Demonstrated hands‑on experience applying and supporting identity security principles and best practices including Zero Trust Architecture, adaptive authentication, conditional access policies, segregation of duties (SoD), and identity threat detection and response.
• Demonstrated hands‑on experience supporting cloud and hybrid identity architectures across platforms such as Azure AD (Entra ID), AWS IAM, and GCP IAM, including integration with on‑premises environments.
• Hands‑on experience with access governance, SoD enforcement, and audit/compliance processes.
• Strong analytical, problem‑solving, and communication skills.
• Experience in Engineering, Procurement, and Construction (EPC) or industrial environments is desired.
• Scripting or automation experience (PowerShell, Python).

Skills and Behaviors

• In addition to providing IAM technical leadership, build and nurture strong partnerships across business, application teams, security, HR, and infrastructure, consistently aligning identity strategies to the organization’s vision, core values, and security principles.
• Strong assessment and analytical expertise to interpret identity governance reports, access certifications, and security monitoring outputs to proactively identify risks, access anomalies, and control gaps, implementing corrective actions before impacting operations.
• Strong knowledge of identity and access management concepts including Identity Lifecycle Management (Joiner, Mover, Leaver), Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), and least privilege access design.
• In‑depth understanding of authentication, authorization, and federation technologies including SSO, MFA, SAML, OAuth 2.0, OpenID Connect, and directory services such as Active Directory and LDAP.
• Strong knowledge of privileged access management (PAM), identity governance and administration (IGA) platforms (e.g., SailPoint, Saviynt, Microsoft Entra ID), and access certification processes.
• Strong understanding of identity security principles and best practices including Zero Trust Architecture, adaptive authentication, conditional access policies, segregation of duties (SoD), and identity threat detection and response.
• Strong working knowledge of cloud and hybrid identity architectures across platforms such as Azure AD (Entra ID), AWS IAM, and GCP IAM, including integration with on‑premises environments.
• Solid understanding of cybersecurity frameworks and standards (e.g., NIST, ISO 27001, SOX, HIPAA) as they apply to identity governance, audit readiness, and compliance controls.
• Solid understanding of encryption technologies and secure credential management including key management, secrets handling, and certificate‑based authentication.
• Strong knowledge of IAM automation and scripting using tools such as PowerShell, Python, and APIs to streamline provisioning, deprovisioning, and access workflows.
• Familiarity with:
  • Identity analytics and identity threat detection tools
  • SOAR and SIEM integrations for identity monitoring
  • Zero Trust and Identity Security Posture Management (ISPM)
  • Cloud‑native identity services and SaaS integrations
• Understanding of risk scoring models, access review methodologies, and industry frameworks related to identity security (e.g., NIST 800‑63, MITRE ATT&CK for credential access).
• Familiarity with enterprise systems such as ERP platforms, engineering tools, and project systems.
• Must have excellent organizational, project management, and communication skills with the ability to manage multiple IAM initiatives and priorities effectively.
• Leverages strong communication and collaboration skills to work with global stakeholders across security, IT, audit, and business units to resolve complex identity and access issues.
• Ability to perform peer reviews of IAM configurations, policies, workflows, and documentation to ensure accuracy, compliance, and adherence to best practices.
• Possesses strong verbal and written communication skills in English, with demonstrated ability to translate complex IAM concepts to all levels of the organization, including executives, auditors, engineers, and subject matter experts.