American Express—Senior Associate-CyberOps & Assurance

Job description

Description: Organizational context: The IAM Servicing team is part of the Amex enterprise Identity & Access Management service portfolio within the broader IT Security organization. The team is engaged in providing best-in-class Identity & access lifecycle management services to the entire Amex organization. Role Expectations: As member of the IAM Servicing team, you will be responsible for: - Performing Access Reviews Operations and ensuring efficacy of various Access Reviews Controls - Provisioning of appropriate identity & access as per user request, defined user roles and organizational access policies. - Analyzing and resolution of user access issues - Interacting with business units on access control governance processes - Owning the entire lifecycle of accounts within multiple applications and works with business units to define user roles enterprise-wide. - Participating with the Information Security team in mitigating access governance risk. Requirements: Qualifications: - 3-5 years experience in Identity & Access Management involving Access Review operations, user access provisioning, administration & Termination/ Emergency termination request handling in a large-scale and complex organization, preferably in BFSI, Retail and Healthcare sectors. - Deep understanding and command on relational database and building SQL queries for various complex data reporting needs. DBA level proficiency (Preferred). - Experience with various ID administration processes for identity namespaces (Active Directory & Mainframe-RACF), Operating Systems (Windows, or Unix/Linux) and Databases (Oracle, SQL etc) - Deep understanding of person & non-person identities & their management in Windows, Unix & Mainframe platforms. - Experience in Shell scripting (Powershell/Korn/Bash) (Preferred) - Hands-on experience on at least one Robotic Process Automation (RPA) solution (Blue Prism, UI Path etc) - Experience in AI tools like ChatGPT, Co-Pilot, Claude, etc., for implementing process improvements (Preferred). - Deep understanding of Identity Lifecycle Management and role-based access management and hands-on experience in administrating user access via LCM solutions like SailPoint IIQ. - Hands-on experience in service request & incident management using ITSM tools like ServiceNow - High level understanding of IAM audit, access reviews, Segregation of Duties (SoD) and privileged access administration - Knowledge of IAM policies and specific standards on all key technology platforms - Experience with gathering functional requirements, deployment of information security tools, and data analysis - Flexible to work on shift and weekend on-call support - Strong problem solving skills and the ability to identify and recommend alternatives - Ability to work with complex details - Excellent communication skills and ability to positively interact with global teams - Excellent work item follow-up skills with attention to quality & details - Shows personal determination and resilience; is optimistic in changing circumstances - Continually seeks and learns from feedback - Is clear when explaining ideas and concepts to others - communication is structured, compelling, and impactful, and creates a credible impression - Involves the right people to ensure the best decisions are made in a timely manner - Challenges the status quo and questions current approaches where appropriate - Takes the initiative to create clarity when changing circumstances cause ambiguity Responsibilities: Job Responsibilities: - Perform Access Reviews operations and ensure completion of access reviews and revocations within the timeline set by the Access Reviews Controls. - Querying various SQL Database Tables and generating reports basis specific adhoc/repetitive requirements, after clearly understanding the data dependencies/schema. - Add, remove, modify and manage user profiles, passwords and account information for network, database and enterprise applications, used throughout the organisation in a timely manner. - Meet processing and turnaround times established by internal procedures and guidelines or as required by service level agreements while still maintaining a customer service focus. - Review requests to ensure compliance with all information security standards and policies. - Follow all information security policies, procedures and guidelines when administering Identity & access to ensure the security of information systems. - File and maintain documentation for future audits and meet regulatory compliance requirements. - Troubleshoot end user technical or access-related issues. - Provides on-call support on high priority, high impact & urgent IAM issues - Provides root cause analysis assistance for incident management - Ensure users have the right access to do their jobs through the creation and maintenance of business roles, account monitoring and management, including managing and resolving orphaned accounts, service accounts and privileged access. - Interface with architecture & engineering team to report, prioritise and follow-up on application enhancements and defect management - Ensures compliance with applicable federal regulations. - Maintains knowledge of and adhere to Amex's internal identity & access management compliance policies and procedures. - Prepares materials (reports, presentations, spreadsheets, etc) on information security to help develop scenarios, response procedures, and to enable informed decision making; verify completeness, accuracy and relevance of data gathered - Utilises tools and documented processes to ensure consistency and optimization of information security processes; work in support of efforts to measure and improve information security processes - Prepares status reports on information security, or other matters to help develop, track, monitor and report on projects and initiatives - Facilitates meetings to gather and document products/services or generic process changes - Maintains internal documentation library, ensuring that process and other documentation is regularly updated to reflect latest operational processes and requirements - Collects and critically evaluates relevant data to foster data-driven decision-making. - Identifies patterns and trends to uncover opportunities. - Applies analytics to facilitate decision-making, synthesizing findings to generate actionable insights. - Simultaneously, visualizes data and communicates insights clearly using narrative techniques to foster data-driven decision-making, translating complex findings into compelling, understandable stories for specific audiences. - Identifies opportunities for process development and improvements for cybersecurity operations through creation/modification of SOPs, playbooks, and work instructions.