IAM Manager

Mission

Assure that only the right people and entities have the right access at the right time to enable the organization to securely reach its goals.

Responsibilities

Responsibility	Domain	Category
Assess existing IAM capabilities, develop a risk-based IAM strategic roadmap aligned with the organization's goals and obtain top management sponsorship for it	All	GOVERNANCE
Embrace Identity and Access Management holistically including Workforce IAM, 3rd Party IAM, Client IAM, Object IAM, Technical IAM or PAM and Physical Access	All	GOVERNANCE
Assure that the IAM function and program are supervised by and report to adequate governing bodies	All	GOVERNANCE
Design and implement IAM policies that establishes clear requirements and accountability for IAM topics	All	GOVERNANCE
Develop an IAM technological roadmap to sustain the organization's digital transformation	All	GOVERNANCE
Find, recruit, retain, train, and develop IAM talents	All	GOVERNANCE
Design and implement authorization processes that assure the legitimacy and appropriateness of access permissions	All	GOVERNANCE
Assure coverage of IAM processes over the information system by dynamically integrating IT Asset Management inventories	All	IDENTIFY
Identify and analyze IAM related risks in alignment with the organization's risk management framework	All	IDENTIFY
Conduct regulatory and industrial watch to identify regulatory, contractual and industrial requirements and best practices	All	IDENTIFY
Facilitate and provide evidences for internal and external audits on IAM related topics and manage related findings and recommendations	All	IDENTIFY
Embed IAM requirements by design in the SDLC, Project, and Change Management processes	All	IDENTIFY
Assure adequate traceability in IAM processes to fullfill compliance and security requirements	All	IDENTIFY
Reconciliate systems with authorizations to identify and act upon anomalous identities and accesses	All	IDENTIFY
Use data analytics to identify and respond to anomalous identities, accesses, and behaviors	All	IDENTIFY
Effectively implement IAM remediation plans to mitigate IAM related risks and remediate findings	All	PROTECT
Implement and maintain role-based and other access control models in consistency with the organizational structure and due respect for the least privilege and its specialized form the need-to-know principles	All	PROTECT
Design, implement, operate, and continuously improve IAM controls to efficiently and effectively assure compliance with regulatory, contractual and industrial best practice requirements	All	PROTECT
Design, implement, and continuously improve privileged and technical access management processes and capabilities to effectively mitigate high privileged access risks	PAM/TAM	PROTECT
Mitigate fraud and accidents by deploying SoD and toxic rights controls	All	PROTECT
Deploy authentication mechanisms whose robustness is commensurate with risk	All	PROTECT
Clean the information system from anomalous identities, including orphaned accounts, and access permissions	All	PROTECT
Implement an efficient off-boarding process that effectively mitigates the risk unauthorized access by employees who left the organization	Workforce IAM	PROTECT
Define and implement a password and secrets management policy	All	PROTECT
Add item: Federation with 3rd parties	3rd Party IAM	PROTECT
Add item: Recertification	Workforce IAM	PROTECT
Add item: Home office and remote access	Workforce IAM, 3rd Party IAM, PAM/TAM	PROTECT
Add item: Identity proofing	All	PROTECT