{"id":2939054,"url":"https://alion.io/job/syntax-iam-lead-mfd","title":"IAM Lead (m/f/d)","company":{"id":1877160,"name":"Syntax","domain":"syntax.com","url":"https://alion.io/company/syntax-com","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SuccessFactors","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Barcelona, Spain"],"countries":["ES"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":59000,"max_usd":153000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":679},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"CyberArk","optional":false},{"name":"ISO 27001","optional":false},{"name":"Least Privilege","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"ServiceNow","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false},{"name":"Windows","optional":true}],"status":"live","first_seen_at":"2026-10-07T00:00:00Z","employer_posted_date":"2026-10-07","last_verified_at":"2026-10-22T12:45:20Z","board_verified":true,"closed_at":null,"days_open":15,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":15},"description":"Syntax is a leading Managed Cloud Provider for Mission Critical Enterprise Applications and has been providing comprehensive technology solutions to businesses of all sizes since 1972. Syntax has undisputed strength to implement and manage ERP deployments (Oracle, SAP) in a secure and resilient private, public or hybrid cloud. With strong technical and functional consulting services, and world-class monitoring and automation, Syntax serves some of North America’s largest corporations across a diverse range of industries. Syntax has offices worldwide, and partners with Oracle, SAP, AWS, Microsoft, IBM and other global technology leaders.\nThe Syntax Security Organisation protects Syntax and its employees, secures the services Syntax sells to its customers, and delivers managed security services to customers globally.\nIdentity at Syntax spans workforce identity in Entra ID, privileged access in CyberArk, identity governance on a ServiceNow-native platform, and SAP and Oracle application identity. The role secures Syntax's own identity estate first. The identity standard then extends to the customer environments Syntax manages.\nThe Identity Lead (m/f/d) is a global, hands-on role that owns identity security for Syntax: the identity standard, the design of non-human identity, the posture and the evidence. The role has no team of its own on day 1 but will act in a matrix management capacity and interact with various global teams and stakeholders. A key aspect of this role is handling non-human and agent identity, meaning service accounts, workloads, and AI agents. The Lead designs the registry and the issuance path. The Lead also owns the evaluation of identity governance to tooling, its recommendation, and its implementation.\nThe Lead owns the identity security standard but does not operate the platforms. The IT and platform teams run the directories day to day and must meet the Lead's standard. Security Engineering owns and runs the CyberArk services. Global Security Operations is the Lead's partner for detecting and responding to identity threats.\nRESPONSIBILITIES\nIdentity Oversight, Standards and Posture\nOwn and maintain the identity standard under the Global Security Framework, including the agent identity pattern, and the metrics that show posture improving.\nSet the Entra ID requirements within the standard: Conditional Access, authentication strength, privileged role management and identity protection signals. Review configuration against them.\nSet the CyberArk requirements within the standard, across SaaS and on-premises: onboarding, rotation and session control. Review Security Engineering's delivery against them.\nSet the SAP and Oracle application identity requirements within the standard: joiner, mover and leaver, emergency access, and segregation of duties evidence.\nOwn the evaluation of identity governance tooling the whole business needs, covering a multi-domain estate and machine identity. Own the recommendations and implementation that follow.\nProduce, from the governance platform, the identity evidence ISO 27001 and SOC 2 require: access certifications and reviews.\nMake the evidence-based case for any further identity capability.\nNon-Human and Agent Identity\nDesign and build the registry of service accounts, workload identities, and AI agents across Syntax tenants. Give each a named owner and a lifecycle and set the standard for it.\nDesign and deliver, with the platform teams, the issuance path for machine credentials: short-lived credentials, workload identity federation, and the retirement of static and hardcoded secrets.\nDefine agent-to-agent authentication, delegation and the audit chain, so that every agent's action is attributable to an identity and an authorising human.\nDefine the agent identity pattern within the standard: how agents are created under Conditional Access and least-privilege policy, and how they are recorded.\nTake recurring agent identity findings from the customer environments Syntax manages into the standard.\nDetection and Response\nWork with Global Security Operations to build out a comprehensive catalogue of detection content, such as token theft, privilege escalation, dormant account use and anomalous agent behaviour. \nWrite and maintain the containment playbooks for compromised accounts and credentials, and support Global Security Operations in identity incidents.\nREQUIRED SKILLS AND EXPERIENCE\n8+ years in identity and access management or security engineering, including hands-on ownership of a production identity platform.\nHands-on experience with machine and workload identity: discovery, ownership and lifecycle of service accounts, secrets management, workload identity federation, certificate lifecycle, short-lived credentials.\nHands-on experience with Entra ID: Conditional Access, Privileged Identity Management, identity protection, app registrations and workload identities.\nHands-on experience with identity governance and administration, including a tooling evaluation or selection taken through to a recommendation and implementation.\nHands-on experience with at least two of the following:\nPrivileged access management: CyberArk or equivalent\nApplication identity for SAP or Oracle: user administration, authorisations, segregation of duties\nIdentity detection and response: Entra sign-in and audit telemetry, SIEM correlation\nDesign experience with OAuth 2.0 and OpenID Connect, including delegated and token-exchange flows. Working knowledge of SAML.\nScripting for automation and evidence: PowerShell or Python, including the Microsoft Graph API.\nHas set an identity standard for teams they did not manage and shown that those teams delivered it.\nFluency in speaking, presenting and writing in English.\nPREFERRED QUALIFICATIONS\nExperience securing AI agents or automation identities: agent registries, delegation, auditability.\nExperience producing identity evidence for ISO 27001 or SOC 2 audits.\nExperience in a managed service provider or multi-tenant environment.\nMicrosoft SC-300, CyberArk Defender or an equivalent certification.\nKEY TECHNOLOGIES\nMicrosoft: Entra ID and Conditional Access, Entra Agent ID, Privileged Identity Management, Microsoft Graph, workload identity federation\nIdentity governance: Clear Skye\nPrivileged access: CyberArk\nERP and secrets: SAP and Oracle authorisations, secrets management\nAdditional mandatory requirements:\nNationality or Work Authorization: Spanish or Portuguese nationality, or alternatively a permanent work permit/VISA for Spain or Portugal.\nWhy Syntax?\nBecome a part of our success story and work in a company with exciting innovation projects that are causing a stir across the industry. We recently launched one of the world's most advanced manufacturing facilities based on SAP S/4HANA Cloud and SAP Digital Manufacturing Cloud for Execution - for Smart Press Shop, a pioneering joint venture between Porsche and forming specialist Schuler.\nCompetitive, above-average compensation\nGlobal tourist: With us, you can also work from abroad from time to time\nFlexible working time models, home office\nAttractive benefits, e.g. health offers\nA modern environment in which the \"you\" is part of it\nOpen feedback culture, flat hierarchies and a motivated team\nIndividual career planning with continuous training and coaching on the job\nBenefits\nFlexible hours, Monday to Thursday 8h, and Fridays.... 6h. In addition, the whole month of August and the first half of September we have an intensive timetable. 28 days holiday (23 days holiday + 4 days at Christmas from 15 December to 15 January + 1 day for your birthday)! \nWindows laptop for work (Dell or Lenovo)!\nApple or Android smartphone...you choose!\nTwo lovely offices with a nice garden to relax and have a coffee\nFree coffee and soft drinks\nKitchen facilities \nMedical insurance with Sanitas\nTraining: Free AWS and SAP certifications, internal workshops and free access to Linkedin E-learning\nFree online English, German, Spanish or French classes through a platform \nOnline Canteen 2.0\n\nYou see a personal challenge in this responsible task? Apply now - and become part of the SYNTAX team!","description_format":"text","description_chars":8132,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"Portuguese","level":"All levels","optional":true},{"language":"English","level":"All levels","optional":false}]},"benefits":["Flexible schedule","Health insurance","Home office"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Enterprise Apps Implementation Partners","Cloud Consulting & Migration"],"lifecycle":[{"event":"open","at":"2026-10-20T16:51:00Z"}],"visa":[],"liveness":{"score":57,"band":"ok","label":"Likely open","p_open":1,"p_active":0.766,"p_room":0.75,"age_days":15,"expected_fill_days":16,"reasons":["conf:2","velocity","win:late"],"computed_at":"2026-10-22T06:10:10Z"},"pay":null,"html_url":"https://alion.io/job/syntax-iam-lead-mfd","json_url":"https://alion.io/job/syntax-iam-lead-mfd.json","meta":{"generated_at":"2026-10-22T13:09:26Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":12077,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1877160},"rest":"https://alion.io/mcp/rest/get_company?id=1877160"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsyntax-iam-lead-mfd"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsyntax-iam-lead-mfd"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsyntax-iam-lead-mfd"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/syntax-iam-lead-mfd\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsyntax-iam-lead-mfd"}]}