Senior IAM Lead

About the role

Nexthink, a provider of digital employee experience management software, is looking for an IAM and Access Control Lead to drive the identity strategy and operational excellence of its corporate identity perimeter. The role leads a small team of senior engineers responsible for the platforms, policies and engineering standards governing how employees, contractors, service accounts and other identities gain, use and lose access. It partners with the CISO on policy and standards and with IT on operational delivery, owning the engineering execution end to end. The position is full-time and hybrid.

Key responsibilities

• Define and own the IAM governance model (principles, standards, decision rights, operating cadence) and maintain the multi-year IAM roadmap
• Set the application prioritization and SaaS onboarding strategy, and define RBAC governance standards
• Design and run the enterprise access review and certification framework, including quarterly privileged access reviews
• Govern access to Workday, NetSuite and Salesforce, lead SoD analysis and support SOX, ISO 27001 and SOC 2 audit readiness
• Own the engineering standards and roadmap for Microsoft Entra ID and Okta, including SSO, passwordless MFA and JIT admin access
• Build and operate the inventory of service accounts, API keys, OAuth apps and machine identities, and reduce orphaned accounts

Required profile

• 8+ years in identity and access management, including 2+ years leading IAM governance, strategy or a senior technical IAM function
• Proven track record of access governance at enterprise scale, including access reviews, RBAC and entitlement rationalisation
• Experience with SoD and access governance over Workday, NetSuite or Salesforce
• Fluent English

Required skills

• Microsoft Entra ID and Okta (Conditional Access, federation, SCIM, OIDC/SAML)
• Privileged access tooling (Entra PIM, Okta privileged access, JIT admin) and a record of reducing standing admin
• Non-human identity governance (service accounts, OAuth apps, secrets management)
• Compliance and audit fluency: ISO 27001, SOC 2 or SOX

What we offer

• Permanent contract and competitive compensation
• Hybrid work model
• Private health insurance (Sanitas) and daily meal vouchers of 11 EUR
• Flexible hours, unlimited vacation and 3 company-paid volunteer days
• Gym subscription allowance, childcare and transport compensation plan
• Partial reimbursement of English and Spanish courses