About CLS

CLS is the trusted party at the centre of the global FX ecosystem. Utilized by thousands of counterparties, CLS makes FX safer, smoother and more cost effective. Trillions of dollars’ worth of currency flows through our systems each day.

Created by the market for the market, our unrivalled global settlement infrastructure reduces systemic risk and provides standardization for participants in many of the world’s most actively traded currencies. We deliver huge efficiencies and savings for our clients: in fact, our approach to multilateral netting shrinks funding requirements by over 96% on average, so clients can put their capital and resources to better use.

CLS products are designed to enable clients to manage risk most effectively across the full FX lifecycle – whether through more efficient processing tools or market intelligence derived from the largest single source of FX executed data available to the market.

Our ambition to make a positive difference starts with our people. Our values underpin everything that we do at CLS and define our working environment:

Pivotal purpose
Trusted guardian
Targeted innovation
Facilitate connections
Delivering excellence
Inclusive culture

Job information:

Functional title – IAM Engineering Lead
Department - CISO
Corporate level - Director
Report to – Head of Security Architecture, Design and Engineering
Location – Iselin, New Jersey. Onsite 2 days per week

What you will be doing:

As Head of IAM Engineering, you will lead the strategic design, implementation, and governance of a comprehensive identity and access management program that protects CLS Services' most critical asset: trusted digital identity. This is a hybrid executive and technical role that bridges security, compliance, and business enablement in a highly regulated financial services environment.

You will be responsible for architecting and scaling identity systems across our workforce, customers, and machine identities—each with distinct risk profiles and regulatory demands. This includes accelerating onboarding of applications and infrastructure into our IGA platform, expanding our PAM scope to network devices and non-traditional endpoints, building a comprehensive secrets management capability, and embedding AI-assisted automation to reduce manual operational burden while maintaining security and auditability.

Key Responsibilities:

Scale application and infrastructure onboardingto IAG through a phased, iterative deployment strategy, prioritizing critical systems and expanding coverage over time to maximize early wins while managing complexity.
Automate provisioning and access reviews using IAG connectors, role-based access control (RBAC) frameworks, and AI-driven workflows to reduce manual errors and accelerate user lifecycle management.
Implement self-service capabilities and identity workflow automation to automate and accelerate onboarding to the IAG platform.
Maintain data quality and integration governance by establishing rigorous data cleansing practices, continuous syncing with authoritative HR systems, and monitoring to ensure accurate, consistent identity and entitlement data.
Where possible Leverage AI and machine learning to generate role recommendations, detect over-permissioning, and automate access certification workflows at scale.
Govern machine identities (workloads, services, future AI agents) through IAG lifecycle management, ensuring all identity types are managed through a unified access governance framework.
Deploy behavioral anomaly detection using AI/ML to identify unauthorized or suspicious IAM activities, including potential abuse by rogue AI agents operating at machine velocity.
Onboard critical device and infrastructure accounts to PAM, including network devices, databases, and cloud infrastructure, implementing just-enough-privilege (JEP) and just-in-time (JIT) access models to reduce standing privileges and blast radius.
Expand PAM scope beyond Linux/Windowsto include network devices, databases, cloud infrastructure (AWS), and non-traditional endpoints (operational technology etc.) where applicable to CLS Services' infrastructure.