Senior Manager - Identity & Access Management

The Senior Manager, Identity & Access Management (IAM), based in Bloomington, MN, will lead the team that protects how every employee, contractor, partner, application, and machine across Donaldson’s global business gains and uses access. Identity is the new perimeter, and this leader will own the strategy, operations, and continuous improvement of our identity platforms, including SailPoint Identity Security Cloud and Microsoft Entra ID, across enterprise and manufacturing environments.

We are looking for a cybersecurity leader, not only an identity technologist: a hands-on doer who builds and develops a strong team, delivers results, and stays ahead of a rapidly changing field. This leader will strengthen compliance and audit readiness, reduce risk through Zero Trust and least privilege, and govern emerging identities such as AI agents, workload identities, and non-human accounts. Qualified candidates must be able toworka hybrid schedule at ourBloomington, MNoffice.

Role Responsibilities

• Lead, coach, and grow a high-performing team of IAM engineers and analysts, setting clear priorities, building technical depth and career paths, and creating a culture of ownership, accountability, and continuous learning.
• Own the IAM strategy and multi-year roadmap aligned with Donaldson’s cybersecurity program, Zero Trust architecture, business priorities, and regulatory and customer requirements.
• Lead the operation and evolution of SailPoint Identity Security Cloud for identity governance and administration, including joiner, mover, and leaver automation, role-based access, access requests, certifications, and separation-of-duties controls.
• Lead Microsoft Entra ID and the broader Microsoft identity stack, including single sign-on, conditional access, multi-factor and phishing-resistant authentication, Privileged Identity Management, and hybrid Active Directory.
• Strengthen privileged access management, least privilege, and just-in-time access for administrators, service accounts, cloud environments, and operational technology in manufacturing plants.
• Establish governance for non-human identities, including service principals, workload identities, API keys, bots, and AI agents, defining how they are provisioned, authorized, monitored, and retired.
• Drive compliance and audit readiness for SOX, TISAX, privacy, and customer requirements through effective controls, timely access reviews, clean evidence, and rapid remediation of findings.
• Partner with security operations to detect and respond to identity-based threats, such as credential theft, MFA fatigue attacks, and token abuse, using identity threat detection and response capabilities.
• Roll up your sleeves to lead critical integrations, platform upgrades, incident response, and complex troubleshooting, while partnering with HR, applications, infrastructure, and business leaders to simplify the user experience.
• Track and evaluate emerging identity trends and technologies, such as passwordless authentication, decentralized identity, AI-driven access analytics, and agentic AI controls, and turn them into practical, phased improvements with measurable outcomes.
• Own enterprise PKI and certificate lifecycle management, including secure issuance, renewal, revocation, automation, and governance of certificates and cryptographic identities.
• Ensure IAM controls support CMMC, DoD/CUI, SOX, TISAX, and other regulatory requirements, maintaining strong control effectiveness, audit readiness, and timely remediation.
• Drive identity lifecycle integration across authoritative sources and enterprise platforms, including HR systems, SailPoint, Oracle, cloud, SaaS, and other critical applications to strengthen joiner/mover/leaver automation and access governance., * Applicants for this position must be currently and legally authorized to work in the United States without the need for current or future sponsorship (e.g., H-1B, J-1, F-1, CPT, OPT, etc.).
• Donaldson will not offer immigration sponsorship or assume sponsorship of an employment visa for this position.
• International relocation or remote work arrangements outside of the U.S. will not be considered.

Employment opportunities for positions in the United States may require use of information which is subject to the export control regulations of the United States. Hiring decisions for such positions are required by law to be made in compliance with these regulations. Applicants for employment opportunities in other countries must be able to meet the comparable export control requirements of that country and of the United States.

• Bachelor’s degree in cybersecurity, computer science, information systems, or a related field, or an equivalent combination of education and relevant experience.
• 7+ years of experience in identity and access management or cybersecurity, including 3+ years leading teams of engineers or analysts.
• Hands-on experience implementing and operating SailPoint (Identity Security Cloud or IdentityIQ) and Microsoft Entra ID in a large, complex enterprise.
• Strong working knowledge of identity protocols and concepts, including SAML, OAuth 2.0, OpenID Connect, SCIM, Kerberos, role-based and attribute-based access control, and privileged access management.
• Proven experience supporting audits and regulatory compliance, including SOX access controls, user access reviews, and remediation of control findings.
• Travel - Up to 10%, * IAM leadership experience within global manufacturing, industrial technology, or a Fortune 500 enterprise.
• Experience with privileged access management platforms such as CyberArk, BeyondTrust, or Delinea, and with Microsoft Privileged Identity Management.
• Experience securing identities for cloud and SaaS platforms (Azure, AWS, Microsoft 365), workload identities, and integrations through APIs and connectors.
• Knowledge of identity threat detection and response, Microsoft Defender for Identity, and the attack techniques adversaries use against identity systems.
• Experience defining access controls for AI agents, copilots, and automation, including permissions, consent, data access boundaries, and auditability.
• Understanding of cybersecurity frameworks and standards such as NIST CSF, ISO 27001, CIS Controls, and Zero Trust architecture.
• Familiarity with access requirements in operational technology and manufacturing environments, including remote access for vendors and plant systems.
• Scripting and automation skills (for example PowerShell, Python, or Microsoft Graph API) and experience with infrastructure-as-code or DevSecOps practices.
• Relevant certifications such as CISSP, CISM, SailPoint Certified IdentityNow Engineer, Microsoft Certified: Identity and Access Administrator Associate, or CIDPRO.
• Excellent communicator who can explain identity risk in business terms, influence stakeholders, and build trust with auditors, executives, and end users alike.

Annual Salary Range: $148,880 - $186,100. Actual salaries will vary based on several factors including, but not limited to applicable work experience, training, education, performance.

Donaldson is committed to solving the world’s most complex filtration challenges. Together, we make cool things. As an established technology and innovation leader, we are continuously evolving to meet the filtration needs of our changing world. Join a culture of collaboration and innovation that matters and a chance to learn, effect change, and make meaningful contributions at work and in communities.