Role Summary/Purpose:
We are looking for a Cloud IAM Engineering Leader to lead engineering, automation, and product ownership for secure access across Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). This leader will own the end-to-end integrity of cloud access configurations, engineering processes, and security controls, ensuring that cloud identities and permissions are consistently governed, automated, resilient, and aligned to business and regulatory requirements. The role combines hands-on technical leadership with delivery accountability. The successful candidate will guide engineers, establish secure engineering patterns, prevent privilege escalation, enforce least privilege, and partner with the Cloud IAM Leader to implement and sustain access security and governance controls. The role will also serve as Product Owner within a SAFe Agile Release Train (ART), translating strategy and risk priorities into a clear, executable product backlog.
Our Way of Working
We’re proud to offer you flexibility. At Synchrony, our way of working allows you to have the option to work from home near one of our Hubs or come into one of our offices. Occasionally you will be required to commute or travel for in person engagement activities such as business or team meetings, training and culture events.
Essential Responsibilities:
- Lead the design, engineering, testing, deployment, and lifecycle management of IAM access configurations and automation for AWS, Azure, and GCP.
- Own the holistic cloud IAM engineering product, including access models, platform configurations, processes, integrations, automation, documentation, operational readiness, control effectiveness, and continuous improvement.
- Establish and enforce secure access patterns that prevent privilege escalation, reduce standing privilege, separate administrative duties, and apply least privilege to human and workload identities.
- Provide technical direction for AWS IAM policies and roles, Azure role-based access control and privileged access capabilities, and GCP IAM roles, bindings, service accounts, and organization-level controls.
- Lead development of reusable Infrastructure as Code and automation using Terraform and Python to build, validate, deploy, monitor, and remediate cloud access configurations through controlled DevOps pipelines.
- Define engineering guardrails, policy testing, peer review, approval, logging, drift detection, exception handling, and rollback practices for access changes.
- Partner with the Cloud IAM Leader to translate cloud access strategy, security requirements, and risk priorities into engineering roadmaps and implemented controls.
- Serve as Product Owner within a SAFe Agile Release Train, owning the team backlog, developing and prioritizing features and stories, defining acceptance criteria, supporting PI Planning, and validating delivered outcomes.
- Balance new capabilities, platform enablement, control remediation, technical debt, operational resilience, and break-fix work based on risk and business value.
- Coordinate identity integrations involving Okta, SailPoint IdentityIQ (IIQ), Active Directory, cloud-native identity services, and enterprise application or platform teams.
- Apply strong Identity Governance and Administration (IGA) knowledge to access request, approval, provisioning, modification, certification, deprovisioning, and evidence processes.
- Guide the design of authentication and authorization integrations using standards and patterns such as SAML, OAuth 2.0, and OpenID Connect where applicable.
- Ensure cloud access configurations support regulatory, audit, and internal control requirements, with traceable approvals and reliable evidence of control operation.
- Lead troubleshooting and resolution of complex authentication, authorization, provisioning, and cloud permissions issues across integrated identity systems.
- Define engineering metrics and product outcomes for delivery predictability, policy quality, excessive access reduction, automation coverage, control compliance, and service reliability.
- Collaborate with Cloud Security Architecture, cloud platform teams, Cyber Defense, Technology Risk, application teams, and other stakeholders to deliver secure and scalable solutions.
- Communicate technical risks, design decisions, delivery priorities, dependencies, and outcomes to engineering teams and senior stakeholders.
- Mentor engineers, raise engineering standards, and foster a culture of secure development, ownership, automation, and continuous learning.
- Manage IAM configuration compliance and ensure remediation service-level agreements (SLAs) are met and remain aligned with Synchrony's standards and cloud security frameworks, including NIST SP 800-53 and CIS Benchmarks.
- Provide the Cloud Program with timely status updates on technical enablers, deliverables, milestones, dependencies, risks, and progress.
- Deconflict issues and take the actions necessary to remove impediments and unblock the Cloud IAM Engineering team's work.
- Prepare for Program Increment (PI) Planning and partner with engineers to draft and refine features, program boards, stories, dependencies, and acceptance criteria.
- Serve as the people manager for the Cloud IAM Engineering team, including coaching, development, performance management, workforce planning, and team engagement.
- Build and sustain relationships with leaders across the technology organization to align priorities, resolve dependencies, and advance Cloud IAM outcomes.
- Evaluate architectures and designs for role-based access control across cloud services and cloud-hosted applications to ensure access is configured appropriately, securely, and in accordance with least-privilege principles.
- Perform other responsibilities as assigned based on business, risk, regulatory, and organizational needs.
Leadership and Partnership Expectations:
This leader is accountable for connecting strategy to execution. The role works in close partnership with the Cloud IAM Leader and cross-functional security, identity, and cloud stakeholders, while maintaining clear ownership for engineering quality, product priorities, delivery outcomes, and the security posture of cloud access configurations. Success requires both strategic judgment and sufficient technical depth to challenge designs, guide implementation, and make informed trade-offs.
Success Measures:
- Cloud access configurations are delivered through repeatable, tested, and auditable engineering processes.
- Least-privilege and privilege-escalation protections are embedded in design, automation, reviews, and ongoing monitoring.
- AWS, Azure, and GCP access patterns are managed consistently while respecting platform-specific security capabilities.
- Identity integrations with Okta, SailPoint IIQ, and Active Directory operate reliably and support governed identity lifecycle processes.
- The ART backlog is prioritized, ready, and aligned to security risk, platform needs, and measurable product outcomes.
- Engineering documentation, operational ownership, control evidence, and stakeholder communication remain current and effective.
Qualifications/Requirements:
- Bachelor Degree and 8+ years of experience in identity and access management, cloud security, platform engineering, security engineering, or a related technology field; or in lieu of Degree, a High School Diploma /GED and 11+ years of experience in identity and access management, cloud security, platform engineering, security engineering, or a related technology
- 3+ years of technical leadership experience guiding engineering delivery, architecture decisions, technical standards, or complex cross-platform implementations.
- Demonstrated engineering experience with IAM capabilities in at least two major cloud platforms, with the ability to lead across AWS, Azure, and GCP.
- Strong knowledge of cloud authorization concepts, including roles, policies, resource permissions, service or workload identities, cross-account or cross-project access, conditional controls, and privileged access.
- Demonstrated ability to identify and mitigate privilege-escalation paths and excessive access while implementing practical least-privilege controls.
- Hands-on development and automation experience using Python and Terraform, including code review, testing, version control, and CI/CD delivery practices.
- Working knowledge of Okta, SailPoint IdentityIQ (IIQ), and Microsoft Active Directory, with the ability to coordinate and troubleshoot integrations across these platforms.
- Strong understanding of IGA principles and processes, including identity lifecycle, access requests, approvals, provisioning, access certification, role governance, segregation of duties, and deprovisioning.
- Experience working in Agile delivery environments and performing Product Owner responsibilities. Experience with SAFe, Agile Release Trains, PI Planning, feature decomposition, backlog prioritization, and acceptance criteria is required.
- Ability to evaluate complex security and engineering issues, make risk-informed decisions, and drive issues through implementation and operational stabilization.
- Excellent written and verbal communication skills, including the ability to explain complex identity and cloud security topics to technical and nontechnical audiences.
Desired Characteristics:
- Bachelor's degree in Computer Science, Cybersecurity, Engineering, Information Systems, or a related field, or equivalent practical experience.
- Experience delivering IAM capabilities in a highly regulated financial services, banking, payments, or fintech environment.
- Experience with cloud-native policy analysis, access review, privileged access, organization policy, or permission-boundary capabilities across AWS, Azure, and GCP.
- Experience with policy as code, automated security testing, configuration compliance, drift detection, observability, and remediation workflows.
- Experience integrating enterprise identity providers and IGA platforms with cloud control planes and developer platforms.
- Relevant certifications such as AWS Certified Security - Specialty, Microsoft Certified: Cybersecurity Architect Expert, Google Professional Cloud Security Engineer, Certified Information Systems Security Professional (CISSP), or SAFe Product Owner/Product Manager.
- Demonstrated success building and leading engineering teams, influencing across organizational boundaries, and delivering durable security outcomes at enterprise scale.
Grade/Level: 12
The salary range for this position is 135,000.00 - 230,000.00 USD Annual and is eligible for an annual bonus based on individual and company performance.
Actual compensation offered within the posted salary range will be based upon work experience, skill level or knowledge.
Salaries are adjusted according to market in CA, NY Metro and Seattle.
Our Way of Working:
We’re proud to offer you flexibility. At Synchrony, our way of working allows you to have the option to work from home near one of our Hubs or come into one of our offices. You will be required to commute to your nearest Hub (either virtual or physical) for in-person engagement activities such as regular business or team meetings, training and culture events.
*Field Sales and some Commercial team roles may have varied location requirements based upon partner obligations or preferences.
Eligibility Requirements:
- You must be 18 years or older
- You must have a high school diploma or equivalent
- You must be willing to take a drug test, submit to a background investigation and submit fingerprints as part of the onboarding process
- You must be able to satisfy the requirements of Section 19 of the Federal Deposit Insurance Act.
- New hires (Level 4-7) must have 9 months of continuous service with the company before they are eligible to post on other roles. Once this new hire time in position requirement is met, the associate will have a minimum 6 months’ time in position before they can post for future non-exempt roles. Employees, level 8 or greater, must have at least 18 months’ time in position before they can post. All internal employees must consistently meet performance expectations and have approval from your manager to post (or the approval of your manager and HR if you don’t meet the time in position or performance expectations).
Legal authorization to work in the U.S. is required. We will not sponsor individuals for employment visas, now or in the future, for this job opening. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or veteran status.
Our Commitment:
When you join us, you’ll be part of an inclusive culture where your individual skills, experience, and voice are not only heard – but valued. Together, we’re building a future where we can all belong, connect, and turn ideals into action. More than 50% of our workforce is engaged in our Employee Resource Groups (ERGs), where community and passion intersect to offer a safe space to learn and grow.
This starts when you choose to apply for a role at Synchrony. We ensure all qualified applicants will receive consideration for employment without regard to age, race, color, religion, gender, sexual orientation, gender identity, national origin, disability, or veteran status. We’re proud to have an award-winning culture for all.
Reasonable Accommodation Notice:
- Federal law requires employers to provide reasonable accommodation to qualified individuals with disabilities. Please tell us if you require a reasonable accommodation to apply for a job or to perform your job. Examples of reasonable accommodation include making a change to the application process or work procedures, providing documents in an alternate format, using a sign language interpreter, or using specialized equipment.
- If you need special accommodations, please call our Career Support Line so that we can discuss your specific situation. We can be reached at 1-866-301-5627. Representatives are available from 8am – 5pm Monday to Friday, Central Standard Time
Job Family Group:
Information Technology