IAM Continuous Assurance Manager (Brazil based only)

As a leader within the Identity & Access Management (IAM) department of the Experian Global Security Office, you will lead a team responsible for evolving the IAM assurance model from periodic assessments to a continuous, risk-based monitoring approach across critical systems.

You will define the IAM assurance framework and reporting approach, with a particular focus on Identity Governance & Administration (IGA) and Privileged Access Management (PAM) controls, partnering with IAM Engineering teams to automate control testing, validations, and evidence collection.

You will work closely with control owners to investigate access-related risks, coordinate remediation activities, and improve control effectiveness. You will also coordinate assurance activities with Internal Audit, Risk Management, and Compliance teams, ensuring clear accountability and the appropriate level of independence.

By leveraging data, analytics, automation, and approved AI capabilities where appropriate, you will help expand monitoring coverage, identify issues earlier, strengthen compliance, and reduce manual effort. You will lead the IAM Assurance operating model and promote effective identity governance, privileged access controls, and continuous assurance practices across the organization.

Key Responsibilities

• Lead the design, implementation, and continuous improvement of IAM Continuous Assurance, including automated control monitoring, risk analysis, exception management, ongoing control validation, and assurance reporting.
• Establish and continuously assess assurance controls related to IGA and PAM, ensuring identity governance, privileged access, and supporting processes operate effectively and that control deficiencies are identified and remediated.
• Define and monitor controls related to identity lifecycle management, access requests and approvals, role-based access control, privileged access, segregation of duties, and periodic access reviews.
• Build repeatable testing and monitoring processes using IAM, HR, IT Service Management, directory, and application data; partner with IAM Engineering to automate control testing and evidence collection through analytics, workflow tools, and approved AI capabilities where appropriate.
• Serve as a subject matter expert in IGA and PAM assurance, including the evaluation of governance processes, technical controls, operational practices, exceptions, and control evidence.
• Identify inappropriate or excessive access, control failures, overdue access certifications, orphan accounts, policy exceptions, privileged access risks, and other identity-related risks; perform root cause analysis and coordinate remediation through to completion.
• Develop risk-based monitoring approaches focused on critical applications, privileged identities, high-risk access, control exceptions, and other material identity-related risks.
• Lead and develop the IAM Assurance team by setting clear objectives, priorities, and performance expectations while building capabilities in risk, controls, assurance, and data-driven decision making.
• Define and maintain the IAM Assurance operating model, ensuring clear accountability, appropriate independence, effective governance, and alignment with organizational frameworks.
• Provide technical and domain leadership in IAM governance, IGA, PAM, access control, and relevant frameworks such as ISO 27001; influence policies, standards, and best practices while remaining current on IAM technologies and industry trends.
• Partner with Internal Audit, Risk, Compliance, Technology, and business stakeholders; oversee relevant audit engagements, maintain IAM governance metrics and reporting, and support audit readiness and timely remediation efforts.
How Success Will Be Measured

• IAM control issues are identified early, assigned to clear owners, and resolved within agreed timelines.
• The effectiveness of IGA and PAM controls is measurable, with increasing automation of monitoring for critical and high-risk controls.
• Access reviews are completed on time with reliable evidence and proper exception management.
• Privileged access risks and exceptions are identified through repeatable monitoring processes and managed through defined remediation procedures.
• Monitoring coverage extends across critical systems and high-risk access, with a continuous reduction in manual gaps.
• Audit requests are supported by complete, consistent, and traceable evidence.
• Leadership receives timely reporting that enables effective understanding and management of IAM risks.
• Control improvements reduce recurring findings, unnecessary access, and avoidable exceptions.

Department: Information Security
Function: Information Technology
Experience Level: Entry Level