Senior Director - Cybersecurity Identity & Access Management

Description

The company is a large healthcare company that delivers insights, products and services aimed at making quality care more accessible and affordable.

The Senior Director of Identity & Access Management is a core cybersecurity executive who sets the enterprise identity vision and strategic architecture and leads a large identity organization of security engineers and practice leaders, delivering resilient enterprise-wide identity services, capabilities and governance models.

The role reports directly to the Chief Information Security Officer (CISO) and calls for deep expertise in identity control frameworks and modern access management architectures. You will own the IAM vision and multi-year roadmap, run operations and risk reporting, and build zero-trust identity controls into every business domain. You will also work with cross-functional leaders, speed up onboarding of products to enterprise-approved identity platforms, and keep executives informed on risk and program progress.

The Medical-Surgical unit (MMS) distributes medical-surgical supplies, pharmaceuticals, diagnostic equipment and related services to non-acute healthcare providers such as physician offices, surgery centers, long-term care providers, laboratories, home health agencies and government facilities. It has about 8,000 employees, 15 distribution centers, around 900 delivery vehicles, more than 2,200 manufacturer partners and over 200,000 customer accounts across the U.S., with a catalog of more than 270,000 SKUs.

Responsibilities

• Set and own the overall IAM vision, multi-year strategy, roadmap and operating model, and hire and manage the IAM organization
• Implement and oversee core IAM capabilities: single sign-on (SSO), multi-factor authentication (MFA), credential vaulting, identity governance, privileged access management, secrets management, lifecycle management, access certifications, threat detection, third-party governance and customer IAM (CIAM)
• Design custom identity solutions for complex or non-standard cases where core IAM services do not fit
• Set performance metrics for identity governance, make sure they are met, and work with business teams to fix non-compliance
• Build strong industry relationships so the company adopts current technology and best practices
• Build and lead cybersecurity metrics and executive reporting, including KPIs
• Work with technology and application teams to move applications onto enterprise-approved identity products and services during cloud migration
• Work with risk and compliance stakeholders to keep full regulatory alignment
• Set up governance and secrets controls for non-human identities (NHI), covering machine identity lifecycle, service account rotation and API credential security across multiple clouds
• Work with the Threat Detection and Response leader to build identity threat detection and response (ITDR) that monitors, detects and fixes anomalous access, credential misuse and identity-based weaknesses in real time
• Lead access governance across business, HR and technology teams to enforce least privilege, role-based access control (RBAC) and automated joiner-mover-leaver workflows
• Design resilient cloud and federated identity models across multi-cloud and hybrid setups (Azure/Entra ID, GCP, Okta), standardizing SSO, MFA and zero-trust conditional access policies
• Lead identity integration and divestiture work for mergers, acquisitions and divestitures, including identity carve-outs, directory consolidation and federation separation
• Design and deliver enterprise identity products and services built for scale, fault tolerance and high availability
• Use automation, artificial intelligence (AI) and machine learning (ML) to improve efficiency, automate lifecycle governance and provisioning, and strengthen proactive identity threat detection

Requirements

• Degree or equivalent experience. Typically 15+ years of professional experience, including 10+ years of leadership, planning, communication, organization and people motivation (or equivalent experience)
• 15+ years of cybersecurity experience, with real depth in identity and access management, engineering and architecture, risk management, compliance and technology, including 10+ years leading teams or enterprise programs
• Hands-on and leadership experience building and running an identity and access management program
• Proven record of driving remediation at scale: setting SLAs, assigning clear ownership, prioritizing backlogs and closing systemic gaps found through incidents, threat hunts and assessments
• Executive-level communication and stakeholder management, including presenting risk, progress and investment needs to senior leaders and influencing their decisions
• Proven ability to set strategy, gain organizational alignment and approvals, and deliver results across security, infrastructure, cloud, application and product, and business teams
• Deep knowledge of identity and access management, engineering, risk management, compliance and architecture
• Strong risk communication: turning detection gaps and remediation trade-offs into business impact, presenting to executives and driving decisions through to closure
• Experience setting oversight metrics and operating rhythms (OKRs, KPIs, reporting, service reviews) and using data to improve alert quality, reduce noise and speed up remediation
• Working knowledge of governance and regulatory expectations, and the ability to work with audit, compliance and privacy teams while running effective detection and response
• Track record of building high-performing teams and leading with integrity, accountability and operational discipline, known for clear communication, sound judgment and reliable delivery
• Experience building multi-year roadmaps and shaping investment in people, tooling, telemetry and automation to improve enterprise detection and remediation
• Proven management of vendor relationships and service contracts for security tools and managed services, including defining requirements and measuring results against outcomes
• Strong grasp of privacy and appropriate monitoring practices; able to work with Legal, Privacy and HR to keep monitoring and investigations within policy and regulation
• Experience running hybrid and cloud environments and working with platform teams to instrument cloud logging, identity signals, endpoint telemetry and network data for reliable detections
• Strong strategic and tactical decision-making: balancing speed and risk, defining compensating controls and driving complex remediation across multiple owners
• Experience leading or sponsoring purple team exercises, tabletop exercises and control validation to keep improving detection coverage and response playbooks
• Trusted leader who earns executive and team credibility through transparency, follow-through and a strong operational excellence culture
• Bachelor's degree in computer science, information security or assurance, engineering or a related field; advanced degree preferred or equivalent experience
• Preferred certifications: CISSP, CISM, GIAC/SANS, +, SSCP, or an equivalent foundational security certification
• Nice to have: Google Cloud Professional Cloud Security Engineer and/or Associate Cloud Engineer, Google Professional Cloud DevOps Engineer, GIAC certifications (e.g., GSEC, GCIH), or cloud and security engineering certifications matching the team's platforms, depending on role focus

Conditions

Base pay range: $174,800 - $291,300

Pay depends on performance, experience and skills, equity, regular job market reviews and geographic market, and follows the company's pay philosophy and applicable regulations

Other compensation such as an annual bonus or long-term incentive may be offered in addition to base pay

Career level: M5

The company is an equal opportunity employer

Benefits

• Competitive compensation package as part of Total Rewards