{"id":91644,"url":"https://alion.io/job/nexthink-senior-iam-lead-2","title":"Senior IAM Lead","company":{"id":1613,"name":"Nexthink","domain":"nexthink.com","url":"https://alion.io/company/nexthink","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SmartRecruiters","truth_index":{"grade":"B","score":75,"open_postings":10,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":39,"computed_at":"2026-11-04T06:34:25Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Madrid, Spain"],"countries":["ES"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":57000,"max_usd":148000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":753},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Design Controls","optional":false},{"name":"GitHub","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"Least Privilege","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Okta","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-07-28T10:10:30Z","employer_posted_date":"2026-07-28","last_verified_at":"2026-11-04T15:40:03Z","board_verified":true,"closed_at":null,"days_open":99,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":99},"description":"Nexthink is the leader in digital employee experience management software. The company provides IT leaders with unprecedented insight allowing them to see, diagnose and fix issues at scale impacting employees anywhere, with any application or network, before employees notice the issue. As the first solution to allow IT to progress from reactive problem solving to proactive optimization, Nexthink enables its more than 1,500 customers to provide better digital experiences to more than 25+ million employees. Dual headquartered in Lausanne, Switzerland and Boston, Massachusetts, Nexthink has 9 offices worldwide. #LI-Hybrid\n We are looking for an IAM and Access Control Lead to drive the identity strategy and operational excellence of Nexthink's corporate identity perimeter. This role leads a small team of senior engineers responsible for the platforms, policies and engineering standards that govern how every employee, contractor, service account and non-human identity gains, uses, and loses access across Nexthink's corporate environment.\nYou will partner with the CISO function on policy and standards, and with IT on operational delivery, owning the engineering execution end to end.\nKey Responsibilities \nIAM Governance & Strategy\nDefine and own the IAM governance model - principles, standards, decision rights, and operating cadence -as the durable internal foundation for the program.\n\nDevelop and maintain the multi-year IAM roadmap, sequencing capability build against business risk and investor expectations.\n\nEstablish the application prioritization and SaaS onboarding strategy: which systems are governed first, to what standard, and on what timeline.\n\nDefine role-based access control (RBAC) governance standards and the target access model across the corporate estate.\n\nScope, commission, and steer external specialist engagements (e.g. role mining, access-model optimization), retaining internal ownership of outcomes and standards.\n\nAccess Reviews & Certification\nDesign and operate the enterprise access review and certification framework - periodic, risk-based, and fully evidenced.\n\nRun recurring access certifications across in-scope applications with documented, audit-ready evidence trails.\n\nEstablish and operate quarterly privileged access reviews; drive standing admin toward zero for all in-scope environments.\n\nBusiness Application Access & Segregation of Duties\nEstablish access governance over core business applications - Workday, NetSuite, and Salesforce - in partnership with the application owners.\n\nLead Segregation of Duties (SoD) analysis: define the conflict ruleset, identify and remediate SoD conflicts, and operate ongoing monitoring.\n\nSupport SOX, ISO 27001, and SOC 2 audit readiness with documented controls, evidence, and remediation tracking; serve as IAM’s primary interface to Internal Audit.\n\nLead NetSuite role design and Salesforce permission rationalization to align entitlements with least privilege and clean role definitions.\n\nIdentity Platform Operations\nOwn the engineering standards and roadmap for Microsoft Entra ID and Okta.\n\nDefine and enforce SSO standards across the SaaS estate, including SAML/OIDC integrations and SCIM provisioning.\n\nDrive passwordless and non-phishable MFA adoption across all employee and privileged access scenarios.\n\nPrivileged Access & Just-In-Time Admin\nDesign and operationalise Just-In-Time admin access (Intune, Entra PIM, Okta privileged access).\n\nAct as the technical escalation point for IAM incidents and high-severity access requests.\n\nNon-Human Identity (NHI) Governance\nBuild and operate the inventory of service accounts, API keys, OAuth applications, and machine identities.\n\nDefine ownership, rotation, and deprovisioning standards for every NHI; eliminate orphaned and over-privileged service accounts across SaaS, GitHub, and cloud IAM.\n\nPrimary Metrics\nAccess certification completion rate and cycle timeliness\n\nSoD conflicts identified vs. remediated (and open-conflict ageing)\n\nSaaS estate onboarding coverage against the governance roadmap\n\nSSO coverage across the SaaS estate; MFA exception rate\n\nPrivileged access SLA and standing-admin count\n\nOrphaned account count; NHI owner coverage\n\n8+ years in identity and access management, including 2+ years leading IAM governance, strategy, or a senior technical IAM function.\n\nDemonstrable track record designing and operating access governance - access reviews/certification, RBAC models, and entitlement rationalisation at enterprise scale.\n\nHands-on experience with Segregation of Duties and access governance over business applications such as Workday, NetSuite, or Salesforce.\n\nOperational expertise in Microsoft Entra ID and Okta - Conditional Access, federation, SCIM, OIDC/SAML.\n\nExperience with privileged access tooling (Entra PIM, Okta privileged access, JIT admin) and a record of reducing standing admin and orphaned accounts.\n\nExperience with non-human identity governance - service accounts, OAuth apps, secrets management.\n\nCompliance and audit fluency: ISO 27001, SOC 2, or SOX - able to design controls and produce audit-ready evidence.\n\nAbility to communicate governance and technical decisions clearly to senior business stakeholders, Finance, and Internal Audit. Fluent English.\n\n We are the pioneers and trailblazers of a global IT Market Category (DEX) that is shaping the future of how the world works, giving our customers’ IT Teams total digital visibility across their enterprise. Our innovative solutions integrate real-time analytics, automation, and employee feedback across all endpoints. This enables our IT teams to solve complex technical challenges, create ever more productive workplaces, and deliver happy, satisfied employees in the digital workplace.\nWith over 1000 employees across 5 continents, Nexthink operates as One Team, connecting, collaborating and innovating to continuously grow. We call our employees ‘Nexthinkers’ and our commitment to diversity, inclusion, and equity is second to none. We currently have over 75 nationalities working with us, from all cultures and backgrounds, speaking many different languages.\nIf you are looking for a change and like a nice atmosphere, lots of challenges, and having fun while working, this is a great opportunity for you! Check what we offer:\n Permanent Contract and a competitive compensation package. \n Amazing centrally located offices near the Bernabeu Stadium. \n Private Health Insurance (Sanitas) and daily meal vouchers of 11 EUR . \n Hybrid work model balancing office and remote work. \n Flexible Hours and unlimited vacation (employees have unlimited paid time off on top of the 23 days of holidays we offer) plus 3 company-paid volunteer days. \n Up to 25 EUR per month for a gym subscription. \n Flexible compensation plan for childcare & public transportation. \n Reimbursement of up to 50% of the cost of English & Spanish classes. \n Fresh fruit, cookies, and soft drinks in the office. \n Regular company and team events like Pizza talks, Team Building activities, Christmas parties, hosting Meetups at the office and more! \n Bonuses for referring successful hires after three months of continuous employment. \nWe set our pay ranges using objective criteria: the scope and level of the role, the skills it takes to do it well, and the relevant market data. Ranges are reviewed every year to remain competitive and fair. We're transparent about this because we think you deserve to know what you're working towards from day one. In accordance with the EU Pay Transparency Directive (2023/970), we publish salary ranges on every Nexthink role. We won't ask what you currently earn or your previous salary. What matters to us is what this role is worth and whether it works for you. Nexthinkers come from all kinds of backgrounds, and that's what makes us stronger. We welcome applications from everyone.","description_format":"text","description_chars":7867,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":["Equity","Health insurance","Hybrid work"],"hiring_locations":[{"name":"Spain","iso":"ES","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["IT Service & Asset Management","Observability & APM"],"lifecycle":[{"event":"open","at":"2026-07-28T10:10:30Z"}],"visa":[],"liveness":{"score":12,"band":"cold","label":"Long shot","p_open":1,"p_active":0.416,"p_room":0.28,"age_days":98,"expected_fill_days":39,"reasons":["conf:0","stale_co","velocity","win:tail","crowd:"],"computed_at":"2026-11-04T06:34:25Z"},"pay":null,"html_url":"https://alion.io/job/nexthink-senior-iam-lead-2","json_url":"https://alion.io/job/nexthink-senior-iam-lead-2.json","meta":{"generated_at":"2026-11-04T16:36:45Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":25336,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-05T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1613},"rest":"https://alion.io/mcp/rest/get_company?id=1613"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fnexthink-senior-iam-lead-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fnexthink-senior-iam-lead-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fnexthink-senior-iam-lead-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/nexthink-senior-iam-lead-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fnexthink-senior-iam-lead-2"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":91644}},{"tool":"search_jobs","arguments":{"company":"nexthink.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":91644},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}