below marketmost similar roles pay hereabove market
This role pays less than
76%
of similar roles. Most pay
$162,530–$246,225
— the blue band above.
At the midpoint, this role pays about
$161k
versus about
$204k
for comparable roles.
Based on 240 similar postings.
Employer
About State Street
State Street Corporation is one of the world''s largest custodian banks and asset managers, providing investment servicing, investment management, and investment research to institutional investors. Industry: Financial Services & Asset Custody
State Street currently has
351 open roles
on FindRole.
Listed pay typically runs
$115,000–$195,944
across 199 roles with salary data.
The IAM Engineering & Operations Lead, VP will lead a global team to advance identity operations for Charles River Development SaaS environments. This role involves managing identity lifecycle operations, privileged access, and service-account security while ensuring audit readiness and continuous improvement. You will engineer and support Active Directory and Microsoft Entra ID environments, design role-based access control models, and oversee access fulfillment through SailPoint. Key responsibilities include operating CyberArk for privileged access management, driving passwordless modernization, and developing PowerShell automation for reporting and validation. You will use Azure Log Analytics and KQL to monitor account activity and investigate security events. The role solves critical security problems by enforcing least-privilege, strengthening segregation of duties, and translating enterprise standards into reliable operating practices within a high-control financial services software context.
Lead and mentor a global team of IAM engineers to deliver identity operations and production support.
Manage IAM service health, including incident response, problem management, and ticket queue resolution.
Engineer and administer Active Directory and Microsoft Entra ID environments for users, groups, and privileged roles.
Operate privileged access management using CyberArk and Azure PIM to enforce least-privilege and segregation of duties.
Govern non-human service accounts by managing inventory, vaulting, and migrating to passwordless authentication.
Conduct periodic access reviews and remediate findings to meet internal, SOC, and regulatory requirements.
Develop PowerShell automation for identity reporting, lifecycle activities, and evidence generation.
Serve as an IAM control owner to provide audit evidence and translate enterprise policies into operational requirements.
What we're looking for
Bachelor's degree in computer science, engineering, information systems, cybersecurity, or a related technical field, or equivalent professional experience.
10+ years of experience in IAM, directory services, cybersecurity engineering, infrastructure operations, or related technology functions.
Experience leading engineers or operational teams.
Deep hands-on expertise with Active Directory, Microsoft Entra ID, Windows Server, Group Policy, identity lifecycle management, RBAC, LDAP, DNS, and hybrid identity integration.
Practical experience with SailPoint or another identity governance and administration platform, and CyberArk or another enterprise privileged access management platform.
Strong PowerShell automation skills; experience with KQL, Azure Log Analytics, security-event analysis, or comparable observability tools is highly desirable (preferred).
Experience governing service accounts, gMSA, non-human identities, password rotation, credential vaulting, access certifications, and segregation-of-duty controls.
Experience operating IAM services in a regulated financial-services, SaaS, or other high-control environment, including audit evidence and remediation responsibilities.
CyberArk Defender, Microsoft identity or Azure certification, CISSP, CISM, or comparable industry certification is preferred (preferred).
Saviynt
Microsoft Entra ID
Azure AD B2C
Cisco Duo
Astrix Security
Identity and Access Management (IAM)
REST APIs
PowerShell
SAML 2.0
OAuth 2.0
OpenID Connect (OIDC)
Active Directory
Microsoft 365
SAP
Salesforce
Informatica
Zero Trust
Workflow Automation
Microsoft Entra ID
Active Directory
AWS IAM Identity Center
Zero Trust
PAM
PKI
SAML
OAuth
LDAP
ADFS
MIM
Kerberos
DNS
Certificate Services
MFA
Conditional Access
Federation