IAM Controls Leader — Detect, Automate, Secure Access

Become an everyday champion — and build a career where your impact fuels financial progress.

What We Do Card Works  Financial Group is a diversified financial services platform building ethical solutions across credit, lending, and the full customer lifecycle. Through our family of companies, Card Works Financial Group tackles the complex challenges that larger financial institutions leave behind. We’re embedded throughout the credit card ecosystem as a lender, servicer, and merchant acquirer.

Who We Are Merrick Bank:
The bank that builds

CardWorks Servicing:
One partner, total performance

Carson Smithfield:
Resolution with respect

With nearly 40 years of operating history, our track record is solid: disciplined in downturns and built to accelerate in recovery. The Card Works Financial Group companies take precise approach in complex markets, as a top three non-prime focused general purpose card issuer and a top fifteen U.S. merchant acquirer.

Our team tackles the industry’s most complex credit and payment challenges. And we believe that excellent work starts with a team that feels supported, respected, and empowered to grow.

Card Works Servicing, LLC provides end-to end operational servicing functions for credit cards, secured cards, and installment loans. We service consumer and small business loans across the credit spectrum and offers backup servicing and due diligence services to capital providers and trustees.

Founded in 1997, Merrick Bank is an FDIC-insured financial institution headquartered in South Jordan, Utah, with over $10 billion in assets. A wholly owned subsidiary of Card Works Financial Group, Merrick Bank serves roughly five million card members and more than 100,000 merchant customers, offering credit cards, recreational loans, deposit accounts, merchant services and bank sponsor ships to consumers and businesses.

Carson Smithfield, LLC provides a variety of post-charge-off debt recovery services, including digital self-service, IVR, live agent, and external agency management.

Position Summary:

The IAM Manager is responsible for the day‑to‑day leadership, execution, and continuous improvement of identity and access management (IAM) detective controls and supporting automation. This role leads a technical team that operates access monitoring, certifications, reconciliations, and alerting capabilities that detect unauthorized or inappropriate access across the enterprise.

The manager ensures IAM detective controls operate effectively, consistently, and in compliance with internal security standards and regulatory expectations. This role partners closely with IAM engineering, cybersecurity operations, risk management, internal audit, and application teams to mature controls through automation, improved data quality, and scalable processes.

The ideal candidate combines people leadership, operational discipline, and technical understanding of IAM controls, with a strong focus on reducing manual effort, improving detection capabilities, and maintaining audit readiness.

Essential Functions:

Leadership & Operational Management Expectation:
Lead the daily operations of a technical IAM controls team, ensuring consistent execution, accountability, and reliable delivery of detective access management services.

Provide day‑to‑day leadership, supervision, and direction for a team responsible for IAM detective controls and automation.

Set clear performance expectations, prioritize work, manage workload distribution, and support ongoing skill development of team members.

Serve as the escalation point for complex operational issues, control failures, or security‑relevant findings.

Ensure consistent execution of IAM detective control processes in alignment with policies, standards, and documented procedures.

IAM Detective Control Execution Expectation:
Ensure detective IAM controls operate effectively and consistently to identify unauthorized or inappropriate access in a timely manner.

Oversee the execution of detective access management controls, including access certifications, authentication configuration reviews, access monitoring, and exception handling.

Ensure controls effectively detect unauthorized…