About the role
MUFG, one of the world's leading financial groups with a rich heritage spanning over 350 years, is seeking an Identity and Access Management Governance Manager at Assistant Vice President level to join their IT Risk division in London. This role offers the opportunity to shape and oversee the governance of identity and access management processes, ensuring robust risk management and compliance across a multi-year remediation programme. You will support the delivery of effective controls, collaborate with diverse teams, and engage with stakeholders at all levels.
* Join a globally recognised financial institution with a rich history and extensive international presence, offering opportunities for professional development and cross-border collaboration.
* Play a key role in shaping the future of identity and access management governance by supporting critical remediation programmes and ensuring compliance with regulatory standards.
* Benefit from a supportive leadership team, inclusive workplace values, flexible working arrangements, and ongoing training opportunities.
What you'll do
As an Identity and Access Management Governance Manager, you will play an essential role in overseeing risk management frameworks related to identity and access controls. Your day-to-day responsibilities will involve collaborating with various teams to define robust controls, developing monitoring strategies that provide transparency into performance metrics, coordinating remediation efforts across business units, and preparing detailed reports for governance meetings. You will also facilitate stakeholder engagement in managing toxic combinations within applications, act as a liaison for audit-related activities, address risks within development lifecycles, and ensure that all participants adhere to established standards.
* Work closely with the wider Identity and Access Management (IAM) team and other control functions to define key controls for IAM processes, ensuring alignment with audit and regulatory requirements.
* Design effective strategies for continuous control monitoring by developing Key Control Indicators (KCIs) and Key Risk Indicators (KRIs) that assess performance across IAM controls.
* Assist in creating formal testing strategies for IAM controls, collaborating with technical teams to ensure thorough evaluation and remediation.
* Monitor progress on remediation initiatives by partnering with technology and business application owners to ensure commitments are met throughout the programme lifecycle.
* Coordinate the Toxic Combination framework by facilitating full participation from business and technology stakeholders, ensuring violations are managed appropriately.
* Prepare comprehensive management information reports for IAM Governance meetings, transparently communicating process performance and escalating issues as needed.
* Act as a point of contact for addressing IAM risks within the Software Development Lifecycle (SDLC), ensuring risks are mitigated effectively.
* Engage proactively with internal and external audit teams regarding identity and access management risks, providing clear communication and documentation.
* Support the design and delivery of remediation programmes to ensure key risks are addressed efficiently while maintaining compliance with industry standards.
* Facilitate clear communication between organisational functions, business units, and offices both locally and internationally to promote understanding of IAM governance.
What you bring
* Demonstrable experience within an Identity and Access Management function in a regulated financial services environment is essential for success in this role.
* At least three years' experience in technology-focused risk or control functions.
* Working knowledge of banking or securities products enables credible engagement with application owners on topics such as toxic combinations or segregation of duties.
* Proven understanding of Information Security and Technology Risk management practices.
* Strong technical knowledge of external laws, regulations (including SOX), policies, frameworks such as NIST or DORA relevant to technology risk is required.
* Experience developing continuous control monitoring strategies—including automation of reporting.
* Ability to develop effective control testing strategies.
* Excellent written and verbal communication skills, able to simplify complex concepts for diverse audiences.
* Educated to degree level; CISSP or CISM qualifications are desirable but not mandatory.
* Meticulous attention to detail combined with strong organisational skills.
What sets this company apart
This organisation stands out as one of the world's most respected financial institutions thanks to its long-standing commitment to integrity, responsibility, fairness, transparency, honesty, and shared growth. Employees benefit from being part of an international network spanning over 50 countries. The company invests heavily in training opportunities and offers flexible working arrangements that support work-life balance.
What's next
We are open to considering flexible working requests in line with organisational requirements.
