Access Manager

Access Manager (FTC 12-months)

About the Project

Transport for London (TfL) has awarded Indra a long‑term contract to operate, develop, enhance and expand ticketing and access control systems across London’s transport network through to 2034, with extension options to 2039.

This programme covers the maintenance, operation and evolution of a large‑scale, complex ecosystem, including turnstiles, validators, ticket machines, sales terminals, back‑office systems, payment gateways, IT infrastructure and cybersecurity that supports over 8.6 million daily journeys.

Therefore, Indra will become TfL’s strategic technology partner to guarantee the operation and evolution of the world’s largest and most sophisticated ticketing system.

Drawing on over 30 years of experience in urban public transport solutions, Indra will manage and evolve all aspects of the system. The project also envisages, in partnership with TfL, the implementation of new technologies to develop the system, make it more efficient and automate key processes; in short, to jointly create the next generation of the ticketing system for London.

Role Overview

The Access Manager is accountable for overseeing and controlling logical and physical access across the Proteus service. The role ensures that access to systems, applications, environments, facilities and privileged functions is granted only to authorised individuals. Working closely with operational, security and business stakeholders, the Access Manager ensures adherence to security policies, contractual obligations, regulatory requirements and audit standards while enabling effective service delivery.

Key Responsibilities

Access Control Governance

• Manage the complete access control lifecycle for users, groups and service accounts.
• Define, maintain and enforce role‑based access models and least‑privilege principles.
• Ensure appropriate segregation of duties controls are implemented and maintained.
• Review and authorise access requests within approved governance frameworks.

Identity Lifecycle Administration

• Coordinate the provisioning, amendment and removal of user access rights.
• Ensure access is revoked promptly following role changes, transfers or employee departures.
• Maintain accurate records of access requests, approvals, modifications and removals.

Privileged Access Management

• Administer privileged, elevated and administrative accounts in accordance with security standards.
• Oversee privileged credential management activities, including password rotation processes.
• Support the deployment, maintenance and governance of privileged access management (PAM) capabilities.

Compliance, Assurance and Audit

• Facilitate periodic user access reviews and recertification activities with application and system owners.
• Provide evidence and documentation to support internal, customer and external audits.
• Ensure ongoing compliance with ISO 27001, PCI DSS, contractual obligations and relevant security frameworks.
• Maintain comprehensive audit records for all access‑related activities.

Identity Services and Authentication

• Support integration activities involving identity providers and authentication platforms.
• Assist with the implementation and enforcement of multi‑factor authentication controls.
• Govern the management of service accounts and other non‑person identities.

Physical Access Oversight

• Coordinate authorised access to offices, secure locations, laboratories and data centre facilities as required.
• Ensure contractor and visitor access is managed in accordance with approved security procedures.

Operational Support and Escalation

• Serve as the primary point of contact for access‑related issues, incidents and escalations.
• Support Service Desk teams with authentication, account and permission‑related investigations.
• Contribute to major incident reviews where identity or access controls may be a contributing factor.

Reporting and Metrics

• Develop and maintain reporting on access requests, approvals, exceptions, compliance status and operational performance.
• Escalate security risks, access control weaknesses and policy breaches where identified.

Skills and Experience

Essential

• Experience administering Identity and Access Management (IAM)…