ppWe are looking for an IAM and Access Control Lead to drive the identity strategy and operational excellence of Nexthink's corporate identity perimeter. This role leads a small team of senior engineers responsible for the platforms, policies and engineering standards that govern how every employee, contractor, service account and non-human identity gains, uses, and loses access across Nexthink's corporate environment. /ppYou will partner with the CISO function on policy and standards, and with IT on operational delivery, owning the engineering execution end to end. /ph3Key Responsibilities /h3h3IAM Governance Strategy /h3ulliDefine and own the IAM governance model - principles, standards, decision rights, and operating cadence -as the durable internal foundation for the program. /liliDevelop and maintain the multi-year IAM roadmap, sequencing capability build against business risk and investor expectations. /liliEstablish the application prioritization and SaaS onboarding strategy: which systems are governed first, to what standard, and on what timeline. /liliDefine role-based access control (RBAC) governance standards and the target access model across the corporate estate. /liliScope, commission, and steer external specialist engagements (e.g. role mining, access-model optimization), retaining internal ownership of outcomes and standards. /li /ulh3Access Reviews Certification /h3ulliDesign and operate the enterprise access review and certification framework - periodic, risk-based, and fully evidenced. /liliRun recurring access certifications across in-scope applications with documented, audit-ready evidence trails. /liliEstablish and operate quarterly privileged access reviews; drive standing admin toward zero for all in-scope environments. /li /ulh3Business Application Access Segregation of Duties /h3ulliEstablish access governance over core business applications - Workday, NetSuite,



and Salesforce - in partnership with the application owners. /liliLead Segregation of Duties (SoD) analysis: define the conflict ruleset, identify and remediate SoD conflicts, and operate ongoing monitoring. /liliSupport SOX, ISO 27001, and SOC 2 audit readiness with documented controls, evidence, and remediation tracking; serve as IAM's primary interface to Internal Audit. /liliLead NetSuite role design and Salesforce permission rationalization to align entitlements with least privilege and clean role definitions. /li /ulh3Identity Platform Operations /h3ulliOwn the engineering standards and roadmap for Microsoft Entra ID and Okta. /liliDefine and enforce SSO standards across the SaaS estate, including SAML/OIDC integrations and SCIM provisioning. /liliDrive passwordless and non-phishable MFA adoption across all employee and privileged access scenarios. /li /ulh3Privileged Access Just-In-Time Admin /h3ulliDesign and operationalise Just-In-Time admin access (Intune, Entra PIM, Okta privileged access). /liliAct as the technical escalation point for IAM incidents and high-severity access requests. /li /ulh3Non-Human Identity (NHI) Governance /h3ulliBuild and operate the inventory of service accounts, API keys, OAuth applications, and machine identities. /liliDefine ownership, rotation, and deprovisioning standards for every NHI; eliminate orphaned and over-privileged service accounts across SaaS, GitHub, and cloud IAM.



/li /ulh3Primary Metrics /h3ulliAccess certification completion rate and cycle timeliness /liliSoD conflicts identified vs. remediated (and open-conflict ageing) /liliSaaS estate onboarding coverage against the governance roadmap /liliSSO coverage across the SaaS estate; MFA exception rate /liliPrivileged access SLA and standing-admin count /liliOrphaned account count; NHI owner coverage /li /ulh3Requirements /h3ulli8+ years in identity and access management, including 2+ years leading IAM governance, strategy, or a senior technical IAM function. /liliDemonstrable track record designing and operating access governance - access reviews/certification, RBAC models, and entitlement rationalisation at enterprise scale. /liliHands-on experience with Segregation of Duties and access governance over business applications such as Workday, NetSuite, or Salesforce. /liliOperational expertise in Microsoft Entra ID and Okta - Conditional Access, federation, SCIM, OIDC/SAML. /liliExperience with privileged access tooling (Entra PIM, Okta privileged access, JIT admin) and a record of reducing standing admin and orphaned accounts. /liliExperience with non-human identity governance - service accounts, OAuth apps, secrets management. /liliCompliance and audit fluency: ISO 27001, SOC 2, or SOX - able to design controls and produce audit-ready evidence. /liliAbility to communicate governance and technical decisions clearly to senior business stakeholders, Finance, and Internal Audit. Fluent English. /liliFluent English. /li /ulpWe are the pioneers and trailblazers of a general IT Market Category (DEX) that is shaping the future of how the world works, giving our customers' IT Teams total digital visibility across their enterprise. Our innovative solutions integrate real-time analytics, automation, and employee feedback across all endpoints. This enables our IT teams to solve complex t /p /p #J-18808-Ljbffr

📌 Senior IAM Lead (Madrid)
🏢 PVH (Tommy Hilfiger/Calvin Klein)
📍 Madrid