Identity and Access Management (IAM) Governance Senior Specialist (Transformation & Modernization ex

Global Information Security (GIS) protects the Bank’s information systems, confidential and proprietary data, and customer information. Within GIS, Identity and Access Management (IAM) ensures the right identities have the right access to the right resources at the right time and in the appropriate context, supporting security, risk, regulatory, and operational requirements., The role will lead transformation across current-state assessment, future-state design, roadmap development, standards and governance, implementation, stakeholder adoption, control-effectiveness measurement, and transition to sustainable operating ownership across human and non-human identities. A core expectation is the ability to use analytics, automation, scripting, AI-enabled solutions, workflow optimization, and reporting to improve IAM decisions, controls, user experience, and operational outcomes. Cloud IAM and cloud entitlement-management experience are preferred complementary capabilities but are not required., * Lead end-to-end IAM transformation from current-state assessment and future-state design through implementation, adoption, control validation, and sustainable operating ownership.

• Define and advance enterprise access controls, SoD, entitlement governance, role engineering, and access models, translating strategy into executable roadmaps.
• Modernize SoD design, rule engineering, preventive and detective controls, oversight, remediation, and exception management.
• Advance RBAC, ABAC, PBAC, Just-in-Time (JIT), runtime authorization, and related access-control models to reduce excessive, conflicting, and unnecessary access.
• Establish standards for role engineering, entitlement taxonomy, permission management, access profiling, ownership metadata, and access-model design.
• Define scalable IAM operating models covering decision rights, ownership, exception authority, escalation, service boundaries, and accountability across IAM, Technology, Security, and Lines of Business.
• Advance governance across human and non-human identities, including workforce and privileged identities, service accounts, workload and application identities, APIs, automation identities, and emerging AI-agent identities.
• Define data, metadata, correlation, normalization, reconciliation, ownership, and quality requirements supporting reliable access decisions, SoD analysis, role engineering, certification, analytics, and control measurement.
• Use analytics, automation, scripting, AI-enabled solutions, workflow optimization, and reporting to identify access risk, improve control effectiveness, reduce manual effort, accelerate decision-making, and scale IAM governance.
• Develop dashboards, metrics, analytics, and reporting that provide actionable insight into entitlements, permissions, access patterns, SoD conflicts, exceptions, lifecycle performance, and control effectiveness.
• Identify opportunities to automate repetitive IAM activities and apply AI-assisted analysis to improve governance, quality assurance, remediation workflows, and operational efficiency.
• Define outcome-based measures for risk reduction, role and entitlement quality, exception aging, access-review effectiveness, lifecycle performance, automation adoption, and control sustainability.
• Review and challenge access-control designs, entitlement models, role structures, and transformation proposals for alignment with IAM principles, least privilege, SoD requirements, and sustainable operating practices.
• Drive stakeholder adoption across IAM, Security, Technology, Architecture, Engineering, Product, and Lines of Business, and translate complex IAM risks and transformation outcomes into clear business decisions for senior leadership., Bank of America and its affiliates consider for employment and hire qualified candidates without regard to race, religious creed, religion, color, sex, sexual orientation, genetic information, gender, gender identity, gender expression, age, national origin, ancestry, citizenship, protected veteran or disability status or any factor prohibited by law, and as such affirms in policy and practice to support and promote the concept of equal employment opportunity, in accordance with all applicable federal, state, provincial and municipal laws. The company also prohibits discrimination on other bases such as medical condition, marital status or any other factor that is irrelevant to the performance of our teammates.

View your “Know your Rights (https://www.eeoc.gov/sites/default/files/2023-06/22-088_EEOC_KnowYourRights6.12.pdf) “ poster.

View the LA County Fair Chance Ordinance (https://dcba.lacounty.gov/wp-content/uploads/2024/08/FCOE-Official-Notice-Eng-Final-8.30.2024.pdf) .

• 10+ years of IAM, Cybersecurity, Access Management, or closely related experience.
• Demonstrated experience leading IAM, access-control, identity-governance, or authorization transformation that materially changed legacy processes, operating models, or technical capabilities.
• Demonstrated ability to define future-state IAM strategy, develop actionable roadmaps, challenge established approaches, and influence enterprise adoption.
• Experience designing, implementing, or governing enterprise access controls, SoD, role-based access, entitlement governance, role engineering, certification, and access lifecycle management, preferably within a large regulated organization.
• Demonstrated hands-on experience using analytics, automation, scripting, AI-enabled solutions, workflow optimization, or reporting to improve IAM outcomes, control effectiveness, risk identification, and operational efficiency.
• Experience building or using IAM dashboards, metrics, data analysis, or reporting to identify trends, support decisions, measure control effectiveness, and drive remediation.
• Ability to translate analytical findings and automation opportunities into scalable IAM processes, controls, and measurable outcomes.
• Experience implementing or governing RBAC, ABAC, PBAC, JIT, runtime, and related access-control frameworks.
• Experience designing or maturing IAM operating models, including ownership, decision rights, exception governance, escalation, accountability, and service boundaries.
• Experience governing human and non-human identities and associated lifecycle, ownership, entitlement, credential, and access-review requirements.
• Experience with identity correlation, entitlement normalization, ownership metadata, reconciliation, and data-quality controls across heterogeneous environments.
• Strong knowledge of IAM architecture, identity attributes and metadata, authentication, federation, least privilege, and access-control principles.
• Strong experience influencing Architecture, Engineering, Security, Product, and Business stakeholders across organizational boundaries.
• Knowledge of relevant security and control frameworks, including NIST, ISO, FFIEC, COBIT, or CSA., * Deep knowledge of SoD modernization, toxic or incompatible access combinations, entitlement governance, role engineering, entitlement taxonomy, and access analytics.
• Thought leadership in emerging IAM capabilities, including access intelligence, AI-assisted IAM, non-human identity governance, continuous authorization, or next-generation entitlement governance.
• Advanced experience applying analytics, scripting, automation, AI agents, or workflow technologies to IAM use cases such as entitlement analysis, access reviews, control monitoring, remediation, quality assurance, and self-service.
• Experience with IGA platforms such as SailPoint, Saviynt, Microsoft Entra ID Governance, Okta, or equivalent technologies.
• Experience with privileged access management platforms such as CyberArk or equivalent.
• Cloud IAM, Cloud Security, or Cloud Entitlement Management experience across AWS, Azure, GCP, SaaS, or cloud-native environments.
• Experience with cloud permission models, cloud roles and identities, CIEM, or cloud entitlement analytics.
• Experience with security, automation, analytics, and reporting tools such as Wiz, Terraform, BloodHound, Splunk, Microsoft Copilot Studio, Power Automate, Microsoft 365 Copilot, Tableau, Power BI, Python, SQL, or similar technologies.
• Excellent executive communication and stakeholder engagement skills, with demonstrated ability to influence through expertise, collaboration, credibility, and strategic thinking.
• Relevant IAM, security, cloud, data, automation, or AI certifications such as CISSP, CCSP, CRISC, CISM, AWS Security Specialty, Azure Security Engineer, Azure AI Engineer Associate, AWS AI Practitioner, or equivalent.

At Bank of America, we are guided by a common purpose to help make financial lives better through the power of every connection. We do this by driving Responsible Growth and delivering for our clients, teammates, communities and shareholders every day.

Being a Great Place to Work and providing a culture of caring is core to how we drive Responsible Growth. We are intentional about fostering an inclusive workplace where every teammate has the opportunity to succeed, build a career and contribute to our shared success. This includes attracting and developing exceptional talent, recognizing and rewarding performance, and supporting our teammates’ physical, emotional, and financial wellness through affordable, competitive and flexible benefits.

We value the unique perspectives individuals bring from all backgrounds and career paths - whether shaped by military service, community college education, or a wide range of work and life experiences. These journeys foster resilience, leadership and innovation, strengthening our workforce and positively impact the communities we serve.

Bank of America is committed to an in-office culture that supports collaboration, engagement, and career development. Our approach includes clear in-office expectations, while providing an appropriate level of flexibility based on role-specific responsibilities and business needs.

At Bank of America, you can build a successful career with opportunities to learn, grow, and make an impact. Join us!, Bank of America aims to create a workplace free from the dangers and resulting consequences of illegal and illicit drug use and alcohol abuse. Our Drug-Free Workplace and Alcohol Policy (“Policy”) establishes requirements to prevent the presence or use of illegal or illicit drugs or unauthorized alcohol on Bank of America premises and to provide a safe work environment.

Bank of America is committed to an in-office culture with specific requirements for office-based attendance and which allows for an appropriate level of flexibility for our teammates and businesses based on role-specific considerations. Should you be offered a role with Bank of America, your hiring manager will provide you with information on the in-office expectations associated with your role. These expectations are subject to change at any time and at the sole discretion of the Company. To the extent you have a disability or sincerely held religious belief for which you believe you need a reasonable accommodation from this requirement, you must seek an accommodation through the Bank’s required accommodation request process before your first day of work.

This communication provides information about certain Bank of America benefits. Receipt of this document does not automatically entitle you to benefits offered by Bank of America. Every effort has been made to ensure the accuracy of this communication. However, if there are discrepancies between this communication and the official plan documents, the plan documents will always govern. Bank of America retains the discretion to interpret the terms or language used in any of its communications according to the provisions contained in the plan documents. Bank of America also reserves the right to amend or terminate any benefit plan in its sole discretion at any time for any reason.

Investment products offered through MLPF&S and insurance and annuity products offered through MLLA:

Are Not FDIC Insured Are Not Bank Guaranteed May Lose Value

Are Not Deposits Are Not Insured by Any Federal Government Agency Are not a condition to Any Banking Service or Activity

Merrill Lynch, Pierce, Fenner & Smith Incorporated (also referred to as “MLPF&S” or “Merrill”) makes available certain investment products sponsored, managed, distributed or provided by companies that are affiliates of Bank of America Corporation (“BofA Corp.”). MLPF&S is a registered broker-dealer, registered investment adviser, Member SIPC and a wholly owned subsidiary of BofA Corp. Insurance and annuity products are offered through Merrill Lynch Life Agency Inc., a licensed insurance agency and wholly owned subsidiary of Bank of America Corporation.

Trust, fiduciary and investment management services are provided by Bank of America, N.A., Member FDIC and wholly owned subsidiary of Bank of America Corporation (“BofA Corp.”).

Bank of America Private Bank is a division of Bank of America, N.A.

Banking products are provided by Bank of America, N.A. and affiliated banks, Members FDIC and wholly owned subsidiaries of Bank of America Corporation.

© 2026 Bank of America Corporation. All rights reserved.