Head of IAM Identity Lifecycle at Standard Chartered Bank Kenya

Key Responsibilities

• The Authorisation Security Team within the Identity and Access Management domain operates as an integrated model consisting of four independent yet interconnected capabilities that together form a closed-loop control system. Identity Lifecycle is established as an evolved capability responsible for end-to-end lifecycle of all identities across the enterprise.

• Identity Lifecycle is the execution backbone of the Authorisation domain, responsible for ensuring every identity, human, non‑human, privileged has a deterministic, observable lifecycle. The role anchors the Bank’s event‑driven provisioning, access decay, and source‑of‑truth alignment, ensuring lifecycle correctness across all platforms.
• The Head of Identity Lifecycle is a senior leadership role that ensures identity state is accurate, resilient and continuously synchronised with enterprise access policy. It provides the connective tissue that propagates policy decisions into operational reality, enabling reliable provisioning, change, reconciliation, and de-provisioning at scale. Head of Identity Lifecycle owns the end-to-end capability for governing identity state across the enterprise. Reporting directly to the Head of Authorisation Security, this role is accountable for the execution and evolution of identity lifecycle processes, ensuring that enterprise access policy is reliably enforced in operational reality. It expects to be a "Founder" leader with full autonomy to hire and groom the team to maintain systemic integrity under continuous change. The effectiveness of this role depends on close collaboration with peer Capability leaders to maintain alignment, manage systemic risk, and ensure the authorisation domain operates as a coherent, governed role.
• Own Identity Lifecycle capability outcomes, including backlog prioritisation, delivery health, and budget stewardship.
• Ensure end-to-end enforcement of Capability policies across all identities.
• Implement and maintain deterministic, event‑driven identity lifecycle processes for all human and non‑human identities, ensuring consistent alignment to authoritative sources of truth.
• Own the execution layer of the Authorisation control‑plane by ensuring timely, accurate provisioning, de‑provisioning, and lifecycle transitions for all identities.
• Detect and remediate lifecycle drift, semantic inconsistencies, operational debt, and deviations from intended access state across all identity types.
• Design and govern access‑decay, time‑bounded access, and lifecycle event patterns to minimise standing privilege and support Zero Standing Privilege objectives.
• Embed automation, observability, and reconciliation practices to minimise risk, including continuous reconciliation against HR, CMDB, and Cloud IAM sources to eliminate lifecycle drift.
• Lead a high-performing team responsible for operational delivery and continuous improvement.
• Partner with other Capabilities to ensure lifecycle execution aligns with policy semantics, privileged access patterns, and assurance signals, preventing system‑wide misalignment.
• Define and track KPIs demonstrating the transition from manual interpretation to automated, deterministic enforcement.
• Partner with other Capabilities in IAM to ensure coherent, enforceable, continuously validated authorisation semantics.
• Act as the connective tissue between business intent, policy semantics, and technical implementation by ensuring that lifecycle logic faithfully and consistently executes defined authorisation rules.
• Support capability growth through hiring input, coaching, and knowledge sharing.

Responsibilities

Strategy

• Define and maintain the multi-year roadmap for identity lifecycle capability, aligned with enterprise IAM transformation.
• Define the enterprise lifecycle architecture, including lifecycle event models, golden flows, and failure‑mode handling across identity types.
• Prioritise initiatives to reduce drift, improve resilience, and strengthen access controls.
• Continuously evaluate emerging lifecycle automation and reconciliation technologies.
• Ensure alignment with other Authorisation Security capabilities for systemic integrity.
• Act as the expert in identity lifecycle area.
• Act as a liaison between business and technical teams to ensure business and technical objectives and requirements are well communicated and understood.
• Partner with the Bank Cyber Operations to design, develop and operationalise identity policy.
• Partner with the Bank Security Architects and Risk Teams to ensure alignment with Enterprise Security approach and Regulatory standards.
• Partner with the Bank Analytics and Strategy teams to translate insights into execution roadmaps.
• Continuously identify opportunities for cost optimization, increase efficiency and process simplification.

Business

• Translate policy and compliance requirements from Identity Role Engineering Capability into operational capability.
• Collaborate with business units to validate outcomes and align with organisational strategy.
• Communicate lifecycle performance, operational debt, and mitigation plans to executives.
• Validate benefits realisation with measurable, outcome-based indicators
• Facilitate integration of business priorities and strategic objectives into delivery roadmaps.
• Translate technical requirements into business value statements for leadership stakeholders.
• Ensure that processes are optimized for transparency, accountability, user experience and continuous improvement.
• Partner with business owners to validate outcomes and benefits realization.
• Work closely with ICS and Stakeholders to ensure that requirements are in line with the bank’s strategy
• Responsible to evolve the craft towards improving automation, simplification and innovative use of latest market trends
• Engage with third-party vendors as appropriate for the project

Processes

• Design, optimise, and operate identity lifecycle processes to ensure consistent enforcement of enterprise policies.
• Implement monitoring, alerting, and reconciliation processes.
• Establish event-driven automation for state updates and compliance checks.
• Maintain comprehensive, auditable records of lifecycle actions.
• Align processes with enterprise architecture, operational practices, and compliance.
• Identify automation and digital enablement opportunities (e.g., workflow, integration, self-service).
• Partner with process owners, operations, and compliance teams to ensure business alignment.
• Successful grooming of delivery backlog facilitating planning ceremonies with clear, aligned outcomes.

Responsibilities

People & Talent

• Lead a high‑scale operational and engineering function that must deliver precision at volume, ensuring lifecycle correctness across tens of thousands of identities.
• Foster a culture of accountability, collaboration, and technical excellence.
• Support career growth and capability-building within your Capability.
• Act as senior Capability representative across technology, business, and compliance partners.
• Act as the primary liaison between business, cybersecurity, and platform teams.
• Communicate product performance, risks, and roadmap to executive stakeholders and governance forums.
• Build capability through coaching, mentoring, and shared practices.
• Contribute to hiring, retention, and professional development.
• Drive stakeholder alignment on adoption plans, investment needs, and decommissioning of legacy platforms.
• Create an environment of trust, open communication, and cross-functional alignment across business, technology, and control functions.
• Collaborate closely with business units, Scrum Masters, and development teams to ensure successful sprint outcomes.

Risk Management

• Identify risks associated with lifecycle enforcement and identity state correctness.
• Identify and mitigate lifecycle failure‑modes such as orphaned identities, stale privileges, attribute misalignment, and event‑handling gaps.
• Maintain a risk register and track remediation plans.
• Ensure continuity and resilience of lifecycle operations under failure conditions.
• Escalate critical risks to executive stakeholders.
• Contribute to audit and risk management with evidence-based artefacts.
• Ensure adherence to ICS governance standards and contribute to shaping internal audit and risk processes.
• Ensures the project follows the standards with respect to risk management as applicable to their domain.
• Adheres to common practices to mitigate risk in their respective domain.

Governance

• Embed governance, compliance, and regulatory standards into lifecycle operations.
• Ensure auditability, transparency, and accountability.
• Demonstrate adherence to enterprise controls.
• Ensure that program decisions and outcomes align with legal, regulatory, and business conduct requirements.
• Act as a role model for integrity, ethics, and responsible delivery practices.
• Ensure all artefacts and assurance deliverables are as per the required standards and policies (e.g., SCB Governance Standards, ESDLC etc.).

Responsibilities

Regulatory & Business Conduct

• Take personal responsibility for embedding the highest standards of ethics, including regulatory and business conduct, across Standard Chartered Bank. This includes understanding and ensuring compliance with, in letter and spirit, all applicable laws, regulations, guidelines and the Group Code of Conduct.
• Effectively and collaboratively identify, escalate, mitigate and resolve risk, conduct and compliance matters.

Key stakeholders

See the consolidated list of responsibilities below

• Peers in IAM Authorisation Security Hive, Hive Tech Lead, PMs and SMs ICS wide, Engineering Leads & Enterprise Security Architecture
• ICS IAM Leadership Team, ICS CISOs, ICS Delivery Team partners, CPOs
• Technology & Architecture & CIOs
• Global Head, ICS Identity & Access Management
• Global Head, Cyber Security Technology
• Global Head, Cyber Security Operations
• Global Technology Service Heads (Production Support, Infrastructure, Testing, SRE, Architecture)

Other Responsibilities

• Embed Here for good and Group’s brand and values in ICS - Identity & Access Management domain. Perform other responsibilities assigned under Group, Country, Business or Functional policies and procedures; Multiple functions (double hats); [List all responsibilities associated with the role]

The ideal candidate will embody the following attributes:

• Strategic Thinker - connects execution with long-term organizational goals.
• Independent Driver - able to lead without heavy oversight.
• Regulatory Mindset - embeds compliance and governance discipline in delivery.
• Trusted Partner - strong communicator with ability to engage stakeholders up to CIO level.
• Delivery-Oriented - relentless focus on achieving OKRs and outcomes.
• Collaborative Leader - fosters alignment, removes silos, and builds trust across teams.

Skills and Experience

Qualifications

Skills and Experience

• 15+ years of total experience as a cyber security professional with at least 8 years demonstrated experience defining and governing enterprise authorisation policy in regulated environments.
• Experience in translating business, regulatory and risk intent into executable policy.
• Experience in establishing capabilities with strong engineering standards.
• Experienced in leading complex, enterprise-wide initiatives with accountability for capability and outcomes.
• Experience designing or governing event‑driven identity lifecycle models, including joiner/mover/leaver patterns and non‑human identity lifecycle.
• Familiar with enterprise directories and identity platforms such as Active Directory, Entra and related IAM technologies
• Familiar with operating systems, middleware, databases, and cloud platforms (Azure/AWS) from identity threats perspective
• Familiar with emerging technologies such as Artificial Intelligences, Agentic AI and Digital Assets from identity threats perspective
• Analytical, delivery-oriented mindset with the ability to balance strategy and execution.
• Exceptional communication (technical and non-technical), collaboration, and leadership skills with a focus on influencing without authority.
• Skilled at identifying risks, driving remediation, and ensuring compliance with audit/regulatory expectations.
• Agile mindset proven by experience with Agile tools.
• Proficient in creating process and solution design documents
• Proficient in stakeholder management and good communication skills. Able to bridge business and technical teams. Able to communicate with senior executives while maintaining alignment with ground-level teams.
• Experience working in banking, finance, or other regulated environments.

Qualifications

• Bachelor’s degree in Cyber Security, Computer Science, Engineering, Banking, Business, or a related field
• Certified Scrum Product Owner (CSPO)
• Relevant certifications would be beneficial.