GRC Analyst - IAM Governance

Roles and Responsibilities

1. Develop, maintain, and enforce IAM policies, standards, and guidelines across Ola Group, ensuring alignment with industry best practices, including least privilege, zero trust, and segregation of duties.
2. Govern the identity lifecycle process — provisioning, role changes, and de-provisioning — ensuring adherence to defined controls and SLAs across all systems, platforms, and entities.
3. Conduct periodic access reviews and entitlement recertification campaigns; track findings to closure and maintain audit-ready evidence in alignment with ISO 27001, PCI-DSS, and applicable regulatory requirements.
4. Assess IAM control effectiveness and identify gaps; document risk, support remediation, and contribute to the IS risk register as part of the broader GRC function.
5. Support internal and external audits — including ISO 27001, PCI-DSS, and SOC 2 — by preparing IAM-related evidence, responding to auditor queries, and maintaining accurate control documentation.
6. Monitor for identity-related risks and policy violations; escalate anomalies and contribute to the development of preventive and compensating controls.
7. Collaborate with IT, Security Engineering, and Compliance teams to integrate IAM governance requirements into security architecture, product onboarding, and change management processes.
8. Maintain IAM governance metrics and reporting; provide regular updates to leadership on access risk posture, audit status, and remediation progress.
9. Contribute to security governance activities within the GRC team, including policy reviews, control self-assessments, and regulatory compliance initiatives, as the scope of the role evolves.
10. Stay current on emerging IAM threats, regulatory changes, and industry developments; apply this knowledge to continuously strengthen identity governance practices across the organization.

Experience & Skill

1. 2–5 years of experience in GRC, information security, or IAM, with demonstrated focus on identity governance, access control, or compliance.
2. Strong understanding of IAM principles, including RBAC, ABAC, identity lifecycle management, and privileged access governance.
3. Familiarity with IAM technologies such as Active Directory, AWS IAM, LDAP, and SSO/MFA platforms — sufficient to conduct access reviews, assess configurations, and identify control gaps.
4. Working knowledge of security and compliance frameworks, including ISO 27001, PCI-DSS, and NIST; experience applying these to IAM control assessments and audit evidence.
5. Experience conducting access reviews, entitlement analysis, and audit evidence collection; comfortable engaging with audit teams and responding to findings.
6. Analytical and detail-oriented; able to identify patterns in access data, document risk clearly, and communicate findings to both technical and non-technical stakeholders.
7. Exposure to automation and scripting (Python, PowerShell) for IAM data extraction, reporting, or workflow improvement is an advantage.
8. Bachelors degree in a related field or equivalent demonstrated experience and knowledge.
9. Experience with AI-based tools and automation to enhance IAM governance workflows — including access review analysis, anomaly detection, and compliance reporting — is a strong plus.