Information Security Risk Analyst II

Become an everyday champion — and build a career where your impact fuels financial progress.

What We Do Card Works  Financial Group is a diversified financial services platform building ethical solutions across credit, lending, and the full customer lifecycle. Through our family of companies, Card Works Financial Group tackles the complex challenges that larger financial institutions leave behind. We’re embedded throughout the credit card ecosystem as a lender, servicer, and merchant acquirer.

Who We Are Merrick Bank:
The bank that builds

CardWorks Servicing:
One partner, total performance

Carson Smithfield:
Resolution with respect

With nearly 40 years of operating history, our track record is solid: disciplined in downturns and built to accelerate in recovery. The Card Works Financial Group companies take precise approach in complex markets, as a top three non-prime focused general purpose card issuer and a top fifteen U.S. merchant acquirer.

Our team tackles the industry’s most complex credit and payment challenges. And we believe that excellent work starts with a team that feels supported, respected, and empowered to grow.

Card Works Servicing, LLC provides end-to end operational servicing functions for credit cards, secured cards, and installment loans. We service consumer and small business loans across the credit spectrum and offers backup servicing and due diligence services to capital providers and trustees.

Founded in 1997, Merrick Bank is an FDIC-insured financial institution headquartered in South Jordan, Utah, with over $10 billion in assets. A wholly owned subsidiary of Card Works Financial Group, Merrick Bank serves roughly five million card members and more than 100,000 merchant customers, offering credit cards, recreational loans, deposit accounts, merchant services and bank sponsor ships to consumers and businesses.

Carson Smithfield, LLC provides a variety of post-charge-off debt recovery services, including digital self-service, IVR, live agent, and external agency management.

The IAM Analyst II is responsible for the execution and facilitation of Identity and Access Management (IAM) detective controls that identify unauthorized, inappropriate, or unnecessary access across the enterprise. This role has primary responsibility for supporting User Access Reviews (UARs), including review preparation, data validation, reviewer coordination, completion monitoring, exception management, evidence retention, and remediation  addition to access certifications, the IAM Analyst II supports other detective IAM controls and monitoring activities, including access reconciliations, authentication and privileged access reviews, access-related monitoring, and investigation of identified exceptions.

The role works closely with application owners, business stakeholders, IAM engineering, cybersecurity, risk management, and audit teams to ensure controls are executed consistently, supported by complete and accurate data, and maintained in an audit-ready state.

The ideal candidate combines strong operational discipline, analytical skills, and an understanding of identity and access management concepts, with an ability to manage recurring control activities involving multiple applications and stakeholders. The role is also expected to identify opportunities to improve control effectiveness, streamline processes, and reduce manual effort through automation.

Essential Functions:

· Facilitate and execute IAM detective controls, with a primary focus on User Access Reviews and access certification activities.
· Coordinate the end-to-end execution of assigned UARs, including preparation, initiation, reviewer engagement, completion tracking, validation, and evidence retention.
· Perform completeness and…