About the role
JOB DESCRIPTION - IAM and GRC Analyst - SailPoint and ServiceNow
Job Details
Job Family: Identity and Access Management and GRC
Experience Level: Intermediate
Primary Platforms: SailPoint and ServiceNow
Control Areas: Logical Access, Segregation of Duties, and Change Management
Employment Type: Full-time or Contract
Role Summary
We are seeking an IAM and IT Controls Analyst with hands-on experience in Identity and Access Management, SailPoint, GRC, and ServiceNow. The role focuses on logical access and change management controls, including Segregation of Duties, role-based access, production access governance, change monitoring, access reviews, and audit evidence validation.
The candidate should have intermediate knowledge of SailPoint and GRC and be able to review access and change management records for compliance with policies, procedures, and control requirements.
Key Responsibilities
Identity and Access Management
Review and validate user access based on job roles and responsibilities.
Confirm that required management approval is obtained before access is provisioned.
Review SailPoint access reports, role definitions, entitlements, access control listings, and access review reports.
Validate Segregation of Duties controls and identify conflicting, excessive, inappropriate, or unnecessary access.
Review privileged and production access and support periodic access reviews and certifications.
Change Management and Production Controls
Validate change management processes and control requirements.
Confirm that developers cannot deploy production changes without independent approval.
Review production changes, approvals, deployment logs, monitoring reports, and supporting evidence.
Validate automated and manual change monitoring processes.
ServiceNow and Audit Evidence
Review ServiceNow change, access, and approval tickets as control evidence.
Validate tickets, workflow approvals, email approvals, and other authorization evidence.
Compare ServiceNow records with SailPoint reports and supporting documents.
Identify missing, incomplete, or inconsistent evidence and coordinate remediation.
GRC and Compliance
Support IT General Controls for logical access, user access management, Segregation of Duties, production access, change management, access reviews, and monitoring.
Assist with control testing and evidence collection for internal and external audits.
Document control observations, exceptions, evidence gaps, and remediation items.
Required Skills
SailPoint and Identity Governance - Intermediate
GRC and IT Controls - Intermediate
ServiceNow - Intermediate
Identity and Access Management - Intermediate
Logical Access Controls - Intermediate
Segregation of Duties - Intermediate
User Access Reviews and Certifications - Intermediate
Change Management Controls - Intermediate
ITGC and Audit Controls - Intermediate
Role-Based Access Control - Intermediate
Audit Evidence Review - Intermediate
Excel and Reporting - Intermediate
Platform and Domain Knowledge
SailPoint
Knowledge of identity governance, entitlement reviews, access certification, roles, entitlements, Segregation of Duties, approval workflows, provisioning, deprovisioning, and SailPoint reporting.
GRC
Knowledge of IT General Controls, logical access controls, change management controls, control design, operating effectiveness, evidence validation, control testing, exception tracking, audit observations, remediation, and risk and compliance documentation.
Preferred Experience and Competencies
Experience working with SailPoint reports and ServiceNow tickets.
Experience supporting internal or external IT audits.
Experience reviewing logical access and change management controls.
Experience validating access requests and change tickets using samples.
Ability to analyze multiple evidence sources and identify discrepancies.
Good understanding of security roles, entitlements, approvals, and access governance.
Strong analytical, documentation, stakeholder management, and communication skills.
Role Emphasis
Deep SailPoint development or connector development experience is not required. The role focuses on IAM governance, controls, reporting, access certification, evidence validation, and audit compliance.