Lead Workforce IAM Governance Specialist

This role is four days onsite at our Seneca One Buffalo, NY location, with the flexibility to work from home one day per week.

Responsible for leading the development, governance, and continuous improvement of Workforce Identity and Access Management (IAM) policies, standards, processes, and controls. Serves as a subject matter expert and strategic partner responsible for advancing IAM governance, regulatory compliance, and modernization initiatives that enhance the organization's security, resiliency, and operational effectiveness.

Lead development and maintenance of enterprise IAM governance frameworks, policies, standards, and procedures to ensure consistent monitoring, control effectiveness, and protection of workforce identities. Drive the development and evolution of IAM strategy, governance models, policies, and operating procedures in partnership with Cybersecurity leadership, Technology, Risk, and business stakeholders. Evaluate emerging IAM technologies, industry best practices, and regulatory requirements to define strategic recommendations and roadmap priorities for IAM governance and modernization initiatives.

Design, implement, and oversee IAM governance reporting, metrics, dashboards, and monitoring capabilities to measure risk, compliance, control effectiveness, and operational performance. Prepare and present risk assessments, governance insights, executive reporting, and strategic recommendations to Cybersecurity leadership and governance committees. Serve as the primary IAM governance partner across Cybersecurity, Technology, Risk Management, Internal Audit, Compliance, and business leadership teams to proactively identify and mitigate risk.

Lead IAM-related audit and regulatory engagements, including coordination of evidence collection, documentation reviews, management responses, issue remediation, and control enhancement activities. Partner with Cybersecurity teams and managers to continuously improve process documentation, governance reporting, performance metrics, and operational maturity. Create and oversee remediation plans, monitor execution against milestones, and provide guidance to stakeholders to ensure timely and effective resolution of identified risks and control gaps.

Foster strong partnerships with stakeholders across the organization to ensure successful implementation and adoption of IAM governance processes and controls. Lead strategic IAM initiatives and modernization efforts, including identity lifecycle management, access certification, role-based access control (RBAC), privileged access governance, segregation of duties, and policy exception management. Provide thought leadership, mentorship, and guidance to analysts and project teams while promoting IAM best practices and governance standards across the organization.

Understand and adhere to the Company's risk and regulatory standards, policies, and controls in accordance with the Company's Risk Appetite. Design, implement, maintain, and enhance internal controls to mitigate risk on an ongoing basis. Identify risk-related issues requiring escalation to management. Promote an environment that supports belonging and reflects the M&T Bank brand. Maintain M&T internal control standards, including timely implementation of internal and external audit findings, as well as any issues raised by external regulators as applicable.

Complete other related duties as assigned.

Partners with Cybersecurity leadership, Technology leadership, Risk Management, Compliance, Internal Audit, external auditors, and business stakeholders across the enterprise. Functions as a recognized IAM subject matter expert, exercising significant independent judgment in determining objectives, approaches, and solutions for complex identity governance, compliance, and risk management challenges. Work is accomplished with limited direction. Serves as a key advisor and escalation point for Workforce IAM governance matters, influencing strategic decisions and driving execution of enterprise IAM initiatives.

Demonstrates advanced knowledge across identity governance, access management, privileged access management (PAM), cloud identity, regulatory compliance, and related cybersecurity disciplines.

No supervisory responsibilities.

Bachelor's degree and a minimum of 5 years’ relevant work experience, or in lieu of a degree, a…