Overview

To succeed, organizations must blend digital and human capabilities.

Responsibilities

• Lead ISPM Findings Triage (Heart of the Role)
• Independently own and drive the triage of identity and entitlement data surfaced by BCG's ISPM system covering:• Human identities
• Non-human identities (service accounts, workloads, bots)
• Privileged and highly sensitive access
• Apply senior-level judgement to classify findings by:• Criticality per BCG risk index
• Acceptable vs. contextual risk vs. noise
• Elimination of false positives using business context and identity risk scoring
• Own prioritisation decisions based on risk impact, blast radius, and business alignment with full autonomy
• Lead Identity Risk Interpretation & Contextualisation
• Independently assess and determine justification for access including:• Excessive privilege
• Dormant but dangerous accounts
• Toxic combinations
• Lateral movement risk
• Map findings to real attack paths, emerging threat patterns, and regulatory requirements
• Translate graph-based insights into authoritative risk narratives for technical teams and executive stakeholders including CISO, CIO, CTO, and CRO
• Shape BCG's identity risk strategy through programme-level recommendations with direct senior leadership visibility
• Own Remediation Outcomes
• Define and drive specific remediation actions including:• Entitlement right-sizing
• Privilege removal or restriction
• Ownership reassignment
• Policy or process refinement
• Serve as the senior point of accountability for remediation progress across IAM, Cloud Security, Application Owners, and GRC
• Influence IGA development roadmap based on findings and remediation patterns
• Track items through closure and validate measurable, reportable risk reduction at enterprise scale
• Own and Mature the Playbook Framework
• Design, own, and continuously improve playbooks for:• Privileged access risk
• Non-human identity governance
• Cloud-to-data access risks
• Orphaned or over-permissioned identities
• Set and own enterprise programme standards including:• Severity thresholds and risk scoring methodology

Qualifications

• 7-9 years of experience in IAM, cloud security, identity governance, or related security analytics
• Deep expertise in:
• Privileged access models and enterprise governance frameworks
• Human vs. non-human identity risk scenarios
• Entitlement and role-based risk analysis at enterprise scale
• Demonstrated ability to independently own complex risk decisions and drive enterprise remediation programmes across multiple senior stakeholder teams
• Strong executive communication skills — able to translate highly technical identity risk into board-level narratives without supervision
• Proven track record of building, owning, and maturing enterprise-scale security programmes and playbooks
• Exposure to Zero Trust frameworks and identity-centric security architecture
• Consistent reduction in unjustified privileged access across the enterprise
• Time-to-triage for ISPM findings at programme scale
• Percentage of findings with clear business justification or active remediation plan
• Demonstrable and reportable reduction in overall identity risk posture
• Increased executive confidence in identity risk reporting and programme maturity
• Quality and adoption of playbooks across IAM and Cloud Security teams

Nice to have

• Hands-on experience with identity platforms such as Okta, Active Directory, and Entra ID
• Exposure to cloud IAM across AWS, Azure, and GCP
• Familiarity with IGA platforms and access review processes