Associate Director, IAM Operations and Governance

The Associate Director, IAM Operations and Governance will lead the team responsible for IAM audit controls and compliance governance across the identity estate.

This hands-on role will set direction, translate strategy into an executable roadmap, assign clear ownership, remove delivery barriers and ensure commitments are completed to the required quality and timelines.

The role will design and operate a modern, automated IAM control environment for SOX, GxP and other regulatory obligations, including continuous monitoring, evidence collection, control-to-evidence traceability, findings management and sustainable remediation.

It will also lead the adoption of agentic AI and workflow automation to reduce manual effort, improve control effectiveness and provide audit-ready assurance.

Key Responsibilities:

• Lead the IAM controls, audit assurance and compliance governance capability, including its people, operating model, roadmap, delivery and outcomes
• Own the IAM control framework for SOX, GxP and other applicable regulatory and enterprise requirements
• Establish continuous controls monitoring across joiner, mover and leaver processes, access approvals, access certification, segregation of duties, privileged access, service accounts, orphaned accounts and excessive or stale access
• Design and implement an automated control library that maps each control to its policy and regulatory requirement, systems in scope, control owner, required evidence, test procedure, exception criteria and remediation workflow
• Apply Agentic AI and workflow automation to collect and validate evidence, detect control failures, identify missing or inconsistent artefacts, maintain traceability and initiate risk-based remediation with appropriate human oversight
• Define safeguards for AI-enabled controls, including data protection, model governance, explainability, access restrictions, validation, audit logging, exception handling and human approval for material decisions
• Lead internal and external IAM audits from planning through closure, ensuring that evidence is complete, accurate and timely
• Own findings, deficiencies and corrective and preventive actions, including root-cause analysis, risk assessment, accountable owners, target dates, validation of closure and prevention of recurrence
• Define key control indicators, compliance dashboards and executive reporting covering control effectiveness, evidence completeness, exceptions, ageing, risk exposure and remediation progress
• Partner with IAM engineering, application owners and business process owners to embed controls by design, simplify evidence production and reduce manual audit effort without weakening assurance
• Build and lead a high-performing team through workforce planning, clear objectives, coaching, delegation, quality review and performance accountability

Basic Qualifications:

• Degree in information security, technology, risk, audit or a related discipline, or equivalent professional experience
• Substantial experience in IAM governance, risk and compliance, with ownership of audit controls in a complex, highly regulated enterprise
• Strong working knowledge of SOX IT general controls and GxP requirements as they apply to identity lifecycle management, access governance, privileged access and electronic records
• Proven experience designing control frameworks, risk and control matrices, test procedures, evidence requirements and control-to-regulation traceability
• Hands-on experience managing access certifications, segregation of duties, privileged access controls, identity risk monitoring, audit requests and remediation of control deficiencies
• Demonstrated ability to automate control monitoring, evidence collection, testing and issue workflows using IAM, GRC, ITSM, analytics or orchestration platforms
• Practical understanding of Agentic AI, including multi-step agent workflows, tool integration, retrieval-based evidence analysis, governance guardrails and human-in-the-loop decision controls
• Proven experience leading and developing multidisciplinary teams and major programmes, translating strategy into executable plans, managing priorities and dependencies, and ensuring delivery through influence across Cyber Security, Quality, Finance, Internal Audit, Risk, Legal, Technology and business functions
• Excellent written and verbal communication skills, with the ability to translate control performance and compliance risk into clear executive decisions

Preferred Qualifications:

• Advanced experience with SailPoint, Saviynt or a comparable identity governance platform, including certification, policy, role and analytics capabilities
• Knowledge of GxP computerised system controls, data integrity principles, electronic records and signatures, validation expectations, and risk-based assurance
• Relevant certification such as CISA, CISSP, CRISC, CGEIT, ISO 27001 Lead Auditor, SailPoint or Saviynt platform certification
• Experience in pharmaceutical, life sciences or another highly regulated industry