Cyber Security GRC - IAM Specialist

Job Purpose

MSC Group's Cruise Division is recruiting a Cyber Security GRC Specialist - Identity & Access Management to support the implementation, operation and continuous improvement of the organization's Identity & Access Management (IAM) controls and services.
The role contributes to IAM activities across Identity Governance & Administration (IGA), Single Sign-On (SSO), Privileged Access Management (PAM), and other approved on-premises and cloud IAM solutions, including One Identity Manager, One Identity Safeguard, Microsoft Entra ID and Entra PIM, Okta, OneLogin and Active Directory.
The specialist will apply approved IAM architecture, standards, roadmaps and procedures; configure and test solutions; maintain documentation; support application onboarding, releases and service monitoring; and escalate material design, investment, supplier or service-level decisions to the accountable senior role.
The role combines developing governance knowledge with hands-on functional and technical execution. It will configure, test, monitor and validate IAM controls, support integrations and provide second-line specialist assistance, escalating complex integrations, control exceptions and high-risk issues through defined support and governance paths.
The specialist works with relevant stakeholders to document identity risks, access decisions, control evidence, findings and remediation actions and to escalate issues requiring senior ownership.

Key Accountabilities

IAM Governance
• Support the maintenance of the IAM service backlog and roadmap by collecting requirements, documenting priorities, monitoring assigned actions and preparing inputs for architecture, investment, licensing, capacity, supplier and service-level decisions.
• Apply and maintain approved IAM policies, standards, control objectives, design principles, operating procedures and RACI documentation.
• Document integration requirements and support the configuration and testing of connections between authoritative sources, applications, infrastructure and cloud platforms, using approved APIs and federation protocols.
• Execute assigned product and service lifecycle activities, including configuration, testing, release support, change records, upgrades, security hardening, operational documentation and retirement tasks, following approved plans and standards.
• Maintain IAM risk, exception and finding records; collect control evidence supporting ISO/IEC 27001, PCI DSS and NIS2 requirements and internal and external audits; monitor remediation actions; and prepare KPI and KRI reporting for review by the accountable senior role.
Identity Governance & Administration (IGA)
• Configure, administer, monitor and document approved IGA capabilities, including Joiner-Mover-Leaver (JML) lifecycle, access request, provisioning, role, entitlement, RBAC and segregation-of-duties controls.
• Support application and data-source onboarding by documenting requirements, configuring and testing approved connectors and workflows, maintaining documentation and escalating design exceptions or production-acceptance issues.
• Execute access-review and recertification activities, identify orphaned, dormant or excessive access, maintain auditable evidence and follow up assigned remediation actions.

Federated Access Management (FAM)
• Configure, administer, monitor and document approved access-management capabilities for application onboarding, Single Sign-On, federation, provisioning, Multi-Factor Authentication, passwordless authentication and Conditional Access.
• Apply and test approved controls for workforce, external and workload identities; document results and escalate exceptions.
• Support the assessment and onboarding of approved cloud IAM capabilities by executing configuration and testing activities and validating required logging, monitoring and support procedures.

Privileged Account & Session Management (PAM/PSM)
• Configure, administer, monitor and document approved privileged-access capabilities, including account onboarding, vaulting, rotation, workflows, session brokering, monitoring and emergency access.
• Apply and test approved privileged-role controls; identify and escalate permanent or excessive administrative access.
• Apply the approved privileged-access model across on-premises and cloud environments.
• Support integrations with identity governance, ticketing, monitoring and SOC processes; investigate assigned events; document findings; track remediation; and escalate complex or high-risk cases.

Qualifications

• Professional fluency in English and Italian, with the ability to prepare clear technical and governance documentation.
• Degree in Cybersecurity, Information Technology, Computer Science, Engineering or a related discipline, or equivalent relevant professional experience.
• 2-5 years of relevant experience in enterprise Identity & Access Management, including practical administration, configuration, testing or support across IGA, access management, federation, cloud identity or privileged-access capabilities.
• Demonstrated experience in IAM solutions configuration, integration, testing, upgrades, troubleshooting, service management and control assurance.
• Strong understanding of IAM integration technologies and standards, including Active Directory, LDAP, SAML, OpenID Connect, OAuth 2.0, SCIM, APIs and identity-data reconciliation.
• Understanding of identity governance processes, including identity lifecycle management, access requests, RBAC, role and entitlement governance, segregation of duties, provisioning, reconciliation, access certification and remediation.
• Understanding of privileged-access controls, including credential vaulting and rotation, privileged-session management, just-in-time and time-bound access, approval workflows, emergency access and monitoring of administrative activity.
• Experience supporting IAM products and services through backlogs, release and change processes, vendor and managed-service coordination, service-level monitoring, incident escalation, documentation and performance reporting.
• Good understanding of Cyber Security risk, compliance and audit requirements, combined with strong analytical, troubleshooting, stakeholder-management and communication skills across Cyber Security, IT, HR, Cloud, application teams and business functions.
• Relevant certifications such as One Identity product certifications, Microsoft SC-300, AZ-500, Okta Certified Professional, IDPro CIDPRO, PAM-related certifications, CISSP, CISM, CISA, CRISC or ISO/IEC 27001 will be considered an advantage.
• Experience with Microsoft Entra ID and Microsoft Entra PIM, including Conditional Access, MFA, passwordless authentication, privileged roles, external identities, service principals, managed identities, access reviews and identity-protection controls will be considered an advantage.

VISA Requirements

What we offer

In compliance with the applicable pay transparency legislation, the following information is provided regarding the initial compensation foreseen for the position.

Contract
• Type of contract: Permanent
• Hybrid working model: 2 days per week remotely
• Applicable Collective Labour Agreement (CCNL): “Addetti agli uffici ed ai terminals delle società di navigazione che esercitano l’armamento privato” – sez. personale di terra
• Gross annual salary (RAL): between €33.000 – €37.000 gross per year, paid over 14 monthly installments
• Meal vouchers: worth €8 per on-site working day
The offer in terms of salary will be determined based on the candidate’s professional experience, technical competencies, and the level of autonomy and responsibility assigned to the role.

Welfare&Wellbeing
We offer a range of Welfare&Wellbeing Initiatives as well as benefits including Productivity award, Health Insurance, Learning opportunities, flexible working hours, Employee Assistance Programme, Discounts & Partnerships within the MSC group.