DirectJobHub
Jobs · North Carolina

Director, Identity & Access Management

AssetMark · Charlotte, NC · 2 wk ago
Hybrid$190k–$220k/yrFull-time
We need to output HTML fragment with sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections if posting has real specific content. The posting includes: description of role, responsibilities, knowledge/skills/abilities, education & experience, compensation (base salary range), hybrid work schedule (must accommodate hybrid schedule and close to Charlotte, NC). Also maybe benefits: mentions "competitive benefits" but not specifics. Should we include Benefits? The instruction: never create Benefits section unless posting actually states them. It says "competitive benefits" but not specifics; that's vague. Might be considered not specific enough. Probably we should not include Benefits because no concrete benefits listed. Pay: we have base salary range $190k-$220k. So include Pay section. Schedule: hybrid work schedule mentioned: "We can only consider candidates for this position who are able to accommodate a hybrid work schedule and are close to our Charlotte, NC office." That's specific enough for Schedule. So include Schedule. About the role: we have introductory paragraphs describing role. Could be About the role. Responsibilities: there is a "Key Responsibilities" list with many bullet-like sentences. We'll extract those as
  • . Requirements: maybe Education & Experience section. Could be Requirements. Qualifications: maybe Knowledge, Skills & Abilities. Could be Skills. But we need to follow headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to decide what goes where. The posting has sections: Job Description (intro), The Job/What You'll Do (more description), Key Responsibilities (list), Knowledge, Skills & Abilities (list), Education & Experience (list), Compensation, Who We Are & What We Offer (mission). We'll map: - About the role: combine the introductory paragraphs (first two paragraphs) describing establishing IAM function, role overview. - Responsibilities: the "Key Responsibilities" list. - Requirements: maybe Education & Experience (10+ years experience, etc.) - Qualifications: maybe Knowledge, Skills & Abilities (technical knowledge). Or we could swap. But we have both Skills and Qualifications headings. Could put Knowledge, Skills & Abilities under Skills, and Education & Experience under Requirements. Qualifications maybe left out if not specific? But we need to include only if posting has real content. We have both sections; we can use them. Thus: About the role:

    About the role

    ...

    Responsibilities:

    Responsibilities

    • ... each bullet
    Requirements:

    Requirements

    • ... education/experience bullets
    Qualifications: maybe we could put nothing? But we have Knowledge, Skills & Abilities which is more like Skills. Could treat that as Skills. Then Qualifications maybe we could omit. But we need to follow instruction: include a section ONLY when posting has real, specific content for it. So if we don't have specific content for Qualifications, we omit it. Skills:

    Skills

    • ... knowledge, skills & abilities bullets
    Pay:

    Pay

    The base salary range for this position is between $190,000-$220,000.

    Schedule:

    Schedule

    Hybrid work schedule required; candidates must be able to accommodate a hybrid schedule and be near the Charlotte, NC office.

    We should not include Benefits because only "competitive benefits" vague. We must preserve all substantive information; not invent or summarize away detail. Need to keep details from responsibilities list etc. Must not omit any bullet content. Must preserve all details. We need to extract each responsibility bullet from the "Key Responsibilities" paragraph. It's a long paragraph with many sentences separated by periods. We need to split into list items each representing a responsibility. The instruction: Use
    • for any list of duties/requirements/benefits. So we need to turn each duty into a li. We must be careful not to lose any detail. Let's parse the responsibilities section: "Key Responsibilities Build and lead AssetMark's centralized enterprise IAM function, including its strategy, operating model, service catalog, technology roadmap, engineering standards, governance practices, budget, vendors, and delivery partners. Establish clear ownership across IAM Engineering, Directory Services, Identity Governance, Privileged Access, IAM Automation, and Compliance/Controls.Define the target-state identity architecture and multi-year roadmap for hybrid identity modernization, Zero Trust, least privilege, secure-by-design access, SSO, federation, MFA, passwordless authentication, identity governance, and application integration. Reduce legacy dependencies and create consistent identity patterns across the enterprise.Lead the design and maturation of Identity Governance & Administration capabilities, including joiner, mover, leaver, contractor, partner, rehire, and non-person identity lifecycle processes; authoritative-source integration; access requests and approvals; birthright access; provisioning and deprovisioning; certifications; entitlement governance; role management; segregation of duties; and automated workflows using standards such as SCIM where appropriate.Provide strategic and technical leadership for Microsoft Entra ID and Active Directory, including directory architecture, identity synchronization through Entra Connect Sync or Cloud Sync, authentication, authorization, Conditional Access, MFA, passwordless authentication, Windows Hello for Business, self-service password reset, federation, external identities, identity protection, and identity governance.Establish governance and operating standards for Active Directory organizational units, naming conventions, delegation, administrative boundaries, directory roles, domain controllers, trusts, DNS dependencies, and lifecycle management. Oversee Group Policy design, management, testing, documentation, exception handling, recovery, and change control.Establish secure authentication and authorization patterns for enterprise applications and SaaS platforms. Govern application registrations, enterprise applications, app roles, consent, federation, and SSO using protocols such as SAML, OAuth 2.0, OpenID Connect, WS-Fed, LDAP, Kerberos, and SCIM, and create repeatable onboarding standards for application teams.Oversee enterprise identity and access administration for Microsoft 365 and SharePoint, including role assignments, licensing-related access, administrative controls, security groups, collaboration settings, information architecture, site and hub structure, permission levels, sharing settings, external collaboration, inheritance, ownership, lifecycle, and access-review practices.Establish least-privilege standards and governance for permissions across applications, infrastructure, SaaS, cloud, file shares, SharePoint, and collaboration platforms. Ensure access is approved by appropriate business or data owners, periodically reviewed, traceable, and promptly removed when no longer required. Use RBAC, ABAC, role engineering, and access analytics where appropriate.Lead the strategy and governance for privileged accounts, vaulting, credential management, session controls, emergency access, tiered administration, privileged access workstations, service accounts, application identities, APIs, secrets, certificates, cloud workloads, managed identities, service principals, and just-in-time elevation. Establish controls for break-glass access and administrative separation.Define identity and access standards across Azure management groups, subscriptions, resource groups, and resources. Govern Azure RBAC, managed identities, workload identities, service principals, application registrations, role assignments, secrets, certificates, keys, and credentials using Azure Key Vault and related services.Establish governance for Microsoft Purview data classification, sensitivity labels, Data Loss Prevention, retention, records management, insider-risk integrations, and related policies. Promote awareness of personally identifiable information, sensitive-data handling requirements, and the relationship between data sensitivity and access decisions.Champion an engineering-first approach using PowerShell, Python, Microsoft Graph, REST APIs, reusable patterns, Git, CI/CD, Terraform or other Infrastructure as Code, testing, monitoring, logging, reconciliation, runbooks, recovery procedures, and disciplined change management. Automate lifecycle events, application onboarding, access reviews, evidence collection, reporting, and credential rotation.Establish monitoring and reporting for Entra sign-in, audit, provisioning, and privileged-activity logs. Partner with Security Operations on Microsoft Sentinel, Log Analytics, KQL, Defender for Identity, risky users, risky sign-ins, compromised accounts, workload-identity threats, and identity-related incident response and remediation.Own the IAM service catalog, service health, operating procedures, service levels, incident and problem management partnership, change governance, documentation, continuity planning, and recovery testing. Establish metrics and executive reporting for service health, risk reduction, control effectiveness, certification completion, privileged access, lifecycle performance, PII policy coverage, excessive permissions, unmanaged sharing, audit findings, and program maturity.Align IAM capabilities to AssetMark security policies and applicable requirements such as SOX, NIST, ISO 27001, and financial-services expectations. Establish clear accountability across IAM, HR, application and platform owners, Cybersecurity, Infrastructure, Risk, Compliance, Privacy, and Internal Audit, and partner with these groups to deliver secure, scalable, automated, and adopted IAM services." We need to split into sensible list items. Each sentence seems a responsibility. We'll split by periods that end a sentence. However some sentences have semicolons inside; we can keep them as part of the item. Let's produce list items: 1. Build and lead AssetMark's centralized enterprise IAM function, including its strategy, operating model, service catalog, technology roadmap, engineering standards, governance practices, budget, vendors, and delivery partners. 2. Establish clear ownership across IAM Engineering, Directory Services, Identity Governance, Privileged Access, IAM Automation, and Compliance/Controls. 3. Define the target-state identity architecture and multi-year roadmap for hybrid identity modernization, Zero Trust, least privilege, secure-by-design access, SSO, federation, MFA, passwordless authentication, identity governance, and application integration. 4. Reduce legacy dependencies and create consistent identity patterns across the enterprise. 5. Lead the design and maturation of Identity Governance & Administration capabilities, including joiner, mover, leaver, contractor, partner, rehire, and non-person identity lifecycle processes; authoritative-source integration; access requests and approvals; birthright access; provisioning and deprovisioning; certifications; entitlement governance; role management; segregation of duties; and automated workflows using standards such as SCIM where appropriate. 6. Provide strategic and technical leadership for Microsoft Entra ID and Active Directory, including directory architecture, identity synchronization through Entra Connect Sync or Cloud Sync, authentication, authorization, Conditional Access, MFA, passwordless authentication, Windows Hello for Business, self-service password reset, federation, external identities, identity protection, and identity governance. 7. Establish governance and operating standards for Active Directory organizational units, naming conventions, delegation, administrative boundaries, directory roles, domain controllers, trusts, DNS dependencies, and lifecycle management. Oversee Group Policy design, management, testing, documentation, exception handling, recovery, and change control. 8. Establish secure authentication and authorization patterns for enterprise applications and SaaS platforms. Govern application registrations, enterprise applications, app roles, consent, federation, and SSO using protocols such as SAML, OAuth 2.0, OpenID Connect, WS-Fed, LDAP, Kerberos, and SCIM, and create repeatable onboarding standards for application teams. 9. Oversee enterprise identity and access administration for Microsoft 365 and SharePoint, including role assignments, licensing-related access, administrative controls, security groups, collaboration settings, information architecture, site and hub structure, permission levels, sharing settings, external collaboration, inheritance, ownership, lifecycle, and access-review practices. 10. Establish least-privilege standards and governance for permissions across applications, infrastructure, SaaS, cloud, file shares, SharePoint, and collaboration platforms. Ensure access is approved by appropriate business or data owners, periodically reviewed, traceable, and promptly removed when no longer required. Use RBAC, ABAC, role engineering, and access analytics where appropriate. 11. Lead the strategy and governance for privileged accounts, vaulting, credential management, session controls,

Similar jobs