HIH - Information Protection Manager-HIH

INTRODUCTION TO EVERNORTH:

Information Protection Manager

Identity & Access Management (IAM)

Focus Area: User Access Review Lifecycle, Identity Governance, Entitlement Management & Compliance

The Information Protection Manager – Identity & Access Management (IAM) is responsible for managing enterprise Identity Governance activities with a primary focus on the end‑to‑end User Access Review (UAR) lifecycle. This role supports regulatory compliance, enforces least‑privilege principles, reduces access‑related risk, and ensures effective execution of access review controls, entitlement governance, and lifecycle oversight across diverse environments.

The Manager will guide a team in delivering consistent, audit‑ready IAM controls aligned to SOX, SOC1/SOC2, HIPAA, GDPR, and internal security policy requirements.

1. 1. User Manage Enterprise User Access Review Lifecycle (UAR)

Manage the design, coordination, and execution of User Access Reviews for all in‑scope systems supporting both human and non‑human identities.Oversee planning g, scheduling, notifications, and configuration of quarterly, semi‑annual, and annual UAR campaigns.Ensure UAR processes reinforce least privilege, separation of duties (SoD), and compliance expectations.Administer the manager certification workflow, ensuring timely participation, follow‑up, and closure of required actions.Support root‑cause analysis and remediation of access discrepancies, entitlement issues, and review exceptions.Identity Governance & Entitlement Management

Manage entitlement inventories, entitlement list validations, and evidence collection for all in‑scope applications.Promote standardized entitlement models and enterprise metadata governance.Partner with application owners to ensure entitlement structures and evidence are accurate and complete.Control Execution, Compliance & Audit Support

Produce audit‑ready documentation and support control execution during internal and external audits (SOX/SOC/HITRUST).Ensure IAM processes comply with internal policies, regulatory requirements, and enterprise control frameworks.Conduct quality assurance checkpoints across review stages to ensure input accuracy, output validation, and approval evidence integrity.Cross‑Functional Collaboration & Stakeholder Engagement

Work closely with Compliance, IT Security, Audit, and Application Teams to support strong IAM governance practices.Build collaborative partnerships with global and offshore teams contributing to IAM operations.Team Leadership & Development

Supervise and mentor IAM analysts, advisors, and QA resources supporting UAR and entitlement governance functions.Help develop operational dashboards, performance metrics, and KPIs to measure UAR lifecycle effectiveness.Drive continuous improvement, process standardization, and operational excellence initiatives.

Qualifications:

Education:

Bachelor’s degree and equivalent experience required

Experience:

11-13 years of experience5–8+ years of experience in Identity & Access Management, Information Security, or related fields.Strong understanding of User Access Review processes, entitlement governance, and least‑privilege concepts.Hands‑on experience with IAM platforms such as Saviynt, including campaign setup and entitlement analysis.Working knowledge of SOX, SOC1/SOC2, HIPAA, GDPR, and IAM control requirements.Experience working with auditors and supporting control narratives, evidence collection, and remediation efforts.Strong analytical, communication, and stakeholder management skills.Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, or related discipline.

Required Skills:

Preferred Qualifications

Familiarity with Privileged Access Management (PAM) and non‑human identity governance.Background working with global teams and hybrid workforce governance.

Success Measures

All UAR cycles completed on time and in an audit‑ready state.High accuracy across IAM UAR and entitlement governance controls, ensuring reliable and consistent control execution.Zero audit findings across internal and external assurance reviews (SOX, SOC1/SOC2, HIPAA, GDPR, HITRUST).UAR cycles, entitlement validations, and evidence packages delivered within compliance timelines.Continuous reduction in access‑related risk through proactive identification and remediation of governance gaps.

Equal Opportunity Statement

Evernorth is an Equal Opportunity Employer actively encouraging and supporting organization-wide involvement of staff in diversity, equity, and inclusion efforts to educate, inform and advance both internal practices and external work with diverse client populations.

About Evernorth Health Services