Role Overview The IAM SoD Business Analyst is responsible for analysing, designing, and implementing Identity and Access Management (IAM) processes with a strong focus on Segregation of Duties (SoD) and access governance. This role bridges business requirements and technical solutions to ensure compliance, security, and risk mitigation across enterprise systems. Key Responsibilities - Requirement Gathering & Analysis
- Collaborate with business and IT stakeholders to gather IAM and SoD requirements.
- Document business processes, workflows, and functional specifications.
- SoD Framework Design
- Define and implement Segregation of Duties and Toxic Combination controls.
- Identify and resolve access conflicts across applications and roles.
- Access Governance
- Support role-based access control (RBAC) and enforce least-privilege principles.
- Conduct access reviews and certifications to maintain compliance.
- Compliance & Audit
- Provide evidence and documentation for audits and regulatory requirements (e.g., SOX, GDPR).
- Assist in risk assessments and remediation plans.
- Stakeholder Management
- Act as liaison between technical teams and business units.
- Communicate effectively to ensure alignment of IAM policies with organizational objectives.
- Tool Expertise
- Work with IAM platforms such as SailPoint, Saviynt, Oracle Identity Manager (OIM).
- Configure workflows and access policies in IAM tools.
Required Skills & Experience - Experience: 5-8 years in IAM, with hands-on SoD and access governance.
- Technical Knowledge: Familiarity with IAM tools (SailPoint, Saviynt, OIM), RBAC, SoD frameworks.
- Business Analysis: Strong skills in requirement gathering, process documentation, and stakeholder communication.
- Compliance Knowledge: Understanding of regulatory standards (SOX, GDPR) and audit processes.
- Tools: Proficiency in MS Visio, JIRA, Confluence SQL for data analysis is a plus.
- Soft Skills: Excellent communication, problem-solving, and analytical abilities.
Preferred Qualifications - IAM certifications (e.g., Certified Identity and Access Manager).
- Experience with mainframe systems and RACF (for certain industries).
- Knowledge of Toxic Combination frameworks.
|
