Role Summary/Purpose:
We are looking for a Cloud IAM Engineering Leader to lead engineering, automation, and product ownership for secure access across Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). This leader will own the end-to-end integrity of cloud access configurations, engineering processes, and security controls, ensuring that cloud identities and permissions are consistently governed, automated, resilient, and aligned to business and regulatory requirements.
The role combines hands-on technical leadership with delivery accountability. The successful candidate will guide engineers, establish secure engineering patterns, prevent privilege escalation, enforce least privilege, and partner with the Cloud IAM Leader to implement and sustain access security and governance controls. The role will also serve as Product Owner within a SAFe Agile Release Train (ART), translating strategy and risk priorities into a clear, executable product backlog.
Our Way of Working
We’re proud to offer you flexibility. At Synchrony, our way of working allows you to have the option to work from home near one of our Hubs or come into one of our offices. Occasionally you will be required to commute or travel for in person engagement activities such as business or team meetings, training and culture events.
Essential Responsibilities:
•Lead the design, engineering, testing, deployment, and lifecycle management of IAM access configurations and automation for AWS, Azure, and GCP.
•Own the holistic cloud IAM engineering product, including access models, platform configurations, processes, integrations, automation, documentation, operational readiness, control effectiveness, and continuous improvement.
•Establish and enforce secure access patterns that prevent privilege escalation, reduce standing privilege, separate administrative duties, and apply least privilege to human and workload identities.
•Provide technical direction for AWS IAM policies and roles, Azure role-based access control and privileged access capabilities, and GCP IAM roles, bindings, service accounts, and organization-level controls.
•Lead development of reusable Infrastructure as Code and automation using Terraform and Python to build, validate, deploy, monitor, and remediate cloud access configurations through controlled DevOps pipelines.
•Define engineering guardrails, policy testing, peer review, approval, logging, drift detection, exception handling, and rollback practices for access changes.
•Partner with the Cloud IAM Leader to translate cloud access strategy, security requirements, and risk priorities into engineering roadmaps and implemented controls.
•Serve as Product Owner within a SAFe Agile Release Train, owning the team backlog, developing and prioritizing features and stories, defining acceptance criteria, supporting PI Planning, and validating delivered outcomes.
•Balance new capabilities, platform enablement, control remediation, technical debt, operational resilience, and break-fix work based on risk and business value.
•Coordinate identity integrations involving Okta, SailPoint IdentityIQ (IIQ), Active Directory, cloud-native identity services, and enterprise application or platform teams.
•Apply strong Identity Governance and Administration (IGA) knowledge to access request, approval, provisioning, modification, certification, deprovisioning, and evidence processes.
•Guide the design of authentication and authorization integrations using standards and patterns such as SAML, OAuth 2.0, and OpenID Connect where applicable.
•Ensure cloud access configurations support regulatory, audit, and internal control requirements, with traceable approvals and reliable evidence of control operation.
•Lead troubleshooting and resolution of complex authentication, authorization, provisioning, and cloud permissions issues across integrated identity systems.
•Define engineering metrics and product outcomes for delivery predictability, policy quality, excessive access reduction, automation coverage, control compliance, and service reliability.
•Collaborate with Cloud Security Architecture, cloud platform teams, Cyber Defense, Technology Risk, application teams, and other stakeholders to deliver secure and scalable solutions.
•Communicate technical risks, design decisions, delivery priorities, dependencies, and outcomes to engineering teams and senior stakeholders.
•Mentor engineers, raise engineering standards, and foster a culture of secure development, ownership, automation, and continuous learning.
•Manage IAM configuration compliance and ensure remediation service-level agreements (SLAs) are met and remain aligned with Synchrony's standards and cloud security frameworks, including NIST SP 800-53 and CIS Benchmarks.
•Provide the Cloud Program with timely status updates on technical enablers, deliverables, milestones, dependencies, risks, and progress.
•Deconflict issues and take the actions necessary to remove impediments and unblock the Cloud IAM Engineering team's work.
•Prepare for Program Increment (PI) Planning and partner with engineers to draft and refine features, program boards, stories, dependencies, and acceptance criteria.
•Serve as the people manager for the Cloud IAM Engineering team, including coaching, development, performance management, workforce planning, and team engagement.
•Build and sustain relationships with leaders across the technology organization to align priorities, resolve dependencies, and advance Cloud IAM outcomes.
•Evaluate architectures and designs for role-based access control across cloud services and cloud-hosted applications to ensure access is configured appropriately, securely, and in accordance with least-privilege principles.
•Perform other responsibilities as assigned based on business, risk, regulatory, and organizational needs.
Leadership and Partnership Expectations:
This leader is accountable for connecting strategy to execution. The role works in close partnership with the Cloud IAM Leader and cross-functional security, identity, and cloud stakeholders, while maintaining clear ownership for engineering quality, product priorities, delivery outcomes, and the security posture of cloud access configurations. Success requires both strategic judgment and sufficient technical depth to challenge designs, guide implementation, and make informed trade-offs.
Success Measures:
•Cloud access configurations are delivered through repeatable, tested, and auditable engineering processes.
•Least-privilege and privilege-escalation protections are embedded in design, automation, reviews, and ongoing monitoring.
•AWS, Azure, and GCP access patterns are managed consistently while respecting platform-specific security capabilities.
•Identity integrations with Okta, SailPoint IIQ, and Active Directory operate reliably and support governed identity lifecycle processes.
•The ART backlog is prioritized, ready, and aligned to security risk, platform needs, and measurable product outcomes.
•Engineering documentation, operational ownership, control evidence, and stakeholder communication remain current and effective.
Qualifications/Requirements:
•Bachelor Degree and 8 years of experience in identity and access management, cloud security, platform engineering, security engineering, or a related technology field; or in lieu of Degree, a High School Diploma /GED and 11 years of experience in identity and access management, cloud security, platform engineering, security engineering, or a related technology
•3 years of technical leadership experience guiding engineering delivery, architecture decisions, technical standards, or complex cross-platform implementations.
•Demonstrated engineering experience with IAM capabilities in at least two major cloud platforms, with the ability to lead across AWS, Azure, and GCP.
•Strong knowledge of cloud authorization concepts, including roles, policies, resource permissions, service or workload identities, cross-account or cross-project access, conditional controls, and privileged access.
•Demonstrated ability to identify and mitigate privilege-escalation paths and excessive access while implementing practical least-privilege controls.
•Hands-on development and automation experience using Python and Terraform, including code review, testing, version control, and CI/CD delivery practices.
•Working knowledge of Okta, SailPoint IdentityIQ (IIQ), and Microsoft Active Directory, with the ability to coordinate and troubleshoot integrations across these platforms.
•Strong understanding of IGA principles and processes, including identity lifecycle, access requests, approvals, provisioning, access certification, role governance, segregation of duties, and deprovisioning.
•Experience working in Agile delivery environments and performing Product Owner responsibilities. Experience with SAFe, Agile Release Trains, PI Planning, feature decomposition, backlog prioritization, and acceptance criteria is required.
•Ability to evaluate complex security and engineering issues, make risk-informed decisions, and drive issues through implementation and operational stabilization.
•Excellent written and verbal communication skills, including the ability to explain complex identity and cloud security topics to technical and nontechnical audiences.
Desired Characteristics:
•Bachelor's degree in Computer Science, Cybersecurity, Engineering, Information Systems, or a related field, or equivalent practical experience.
•Experience delivering IAM capabilities in a highly regulated financial services, banking, payments, or fintech environment.
•Experience with cloud-native policy analysis, access review, privileged access, organization policy, or permission-boundary capabilities across AWS, Azure, and GCP.
•Experience with policy as code, automated security testing, configuration compliance, drift detection, observability, and remediation workflows.
•Experience integrating enterprise identity providers and IGA platforms with cloud control planes and developer platforms.
•Relevant certifications such as AWS Certified Security - Specialty, Microsoft Certified: Cybersecurity Architect Expert, Google Professional Cloud Security Engineer, Certified Information Systems Security Professional (CISSP), or SAFe Product Owner/Product Manager.
•Demonstrated success building and leading engineering teams, influencing across organizational boundaries, and delivering durable security outcomes at enterprise scale.
Grade/Level: 12
The salary range for this position is 135,000.00 - 230,000.00 USD Annual and is eligible for an annual bonus based on individual and company performance.
Actual compensation offered within the posted salary range will be based upon work experience, skill level or knowledge.
Salaries are adjusted according to market in CA, NY Metro and Seattle.
Our Way of Working :
We’re proud to offer you flexibility. At Synchrony, our way of working allows you to have the option to work from home near one of our Hubs or come into one of our offices. You will be required to commute to your nearest Hub (either virtual or physical) for in-person engagement activities such as regular business or team meetings, training and culture events.
*Field Sales and some Commercial team roles may have varied location requirements based upon partner obligations or preferences.
Eligibility Requirements:
•You must be 18 years or older
•You must have a high school diploma or equivalent
•You must be willing to take a drug test, submit to a background investigation and submit fingerprints as part of the onboarding process
•You must be able to satisfy the requirements of Section 19 of the Federal Deposit Insurance Act.
•New hires (Level 4-7) must have 9 months of continuous service with the compan