Lead PAM Risk Analyst

Job Description:

Position Summary

We are seeking a Lead PAM Risk Analyst to strengthen enterprise privileged access governance, risk management, compliance, and access controls. The role will identify and mitigate privileged-access risks, lead access reviews and remediation, support audits, and partner with technology and security teams to improve the organization’s security posture.

Key Responsibilities

• Governance and Risk
• Conduct privileged access reviews and entitlement assessments across critical systems.
• Identify, analyze, and drive remediation of risks involving privileged accounts, service accounts, and elevated access.
• Review exceptions, policy violations, and privileged access requests to confirm that appropriate controls are in place.
• Monitor compliance with PAM policies, standards, and regulatory requirements.
• Audit and Compliance
• Support internal and external audits by providing evidence, reports, and risk assessments.
• Analyze access-related findings and coordinate remediation with application, infrastructure, and security teams.
• Maintain process documentation, control procedures, and operational standards.
• Reporting and Collaboration
• Develop risk metrics, dashboards, and executive reporting for PAM governance programs.
• Partner with IAM, Infrastructure, Security Operations, and Application teams to strengthen access governance and reduce risk.
  

• Bachelor’s degree in Information Technology, Cybersecurity, or a related field.
• At least 6 years of experience in IAM, PAM, IT risk, information security, or audit.
• Strong understanding of privileged access management, access governance, and security controls.
• Experience supporting SOX, SOC, NIST, ISO 27001, or comparable compliance frameworks.
• Strong analytical, risk-assessment, and stakeholder-management skills.
  
  

• Experience with CyberArk, SailPoint, Microsoft Entra ID, or comparable IAM and PAM platforms.
• Knowledge of identity governance, access certification, segregation of duties (SoD), and access lifecycle management.
• Relevant security, IAM, risk, or audit certification, such as CISA, Security+, CyberArk, CISSP, or CRISC.
  
  

• Access reviews
• Risk and compliance
• Identity governance
• Audit support
• SOX controls
• Access certification
• Segregation of duties (SoD)
• IAM
• Security reporting
  
  

• Reduced privileged-access risks and audit findings.
• Timely completion of access certifications and remediation actions.
• Successful audit outcomes and sustained compliance.
• Improved governance, reporting, and risk visibility across privileged-access environments.