Security Analyst I – Identity & Access Management (IAM) & Compliance

Bryn Mawr, PA

Full-time

Onsite

Entry Level

Essential Utilities, Inc. delivers safe, clean, reliable services that improve quality of life for individuals, families, and entire communities. The Security Analyst I – Identity & Access Management (IAM) & Compliance is responsible for supporting the operation and governance of enterprise IAM controls, assisting with compliance monitoring and control execution across IT and OT environments.

Apply Now

Responsibilities

Participates as a member of the Information Security Governance, Risk, and Compliance (GRC) team with primary focus on Identity & Access Management and access governance
Assists in the administration and operation of IAM and access-related audit and governance toolsets, including access certifications, provisioning validation, privileged access reporting, and identity governance workflows
Execute and document periodic access reviews, role validations, and privileged access attestations for enterprise systems under guidance
Support the enforcement of least-privilege and role-based access models across on‑premises, cloud, and OT environments
Monitor IAM control effectiveness, track exceptions, and coordinate remediation of access control gaps with system and application owners
Support IAM-related audit activities by collecting evidence, responding to auditor requests, and documenting control procedures
Assist in maintaining and improving IAM processes, tooling, and reporting related to joiner, mover, and leaver (JML) lifecycle management
Maintain documentation, metrics, and dashboards that communicate access risk posture, trends, and remediation status to Information Security leadership
Support the administration and operation of the File Integrity Monitoring (FIM) solution, including alert review, tuning, and validation of authorized changes
Assist in compliance processes related to user access controls, including JML validation and privileged access oversight
Support compliance activities related to Sarbanes-Oxley (SOX) application and system change management controls
Assist with investigating unauthorized or unapproved changes identified through FIM or audit activities
Help maintain audit-ready control documentation, evidence repositories, and process descriptions supporting SOX, internal audit, and regulatory reviews
Participate in efforts to improve compliance processes tied to access management and system change controls
Collaborate with Information Security, IT Operations, Application Owners, and Internal Audit for access and compliance matters
Contribute to the review of policies, standards, and procedures related to access control and compliance monitoring
Participate in risk assessments and control testing activities related to IAM and compliance domains
Support IAM and compliance activity within OT environments, learning the unique requirements of industrial control and supervisory systems
Assist with access governance and monitoring for OT systems in coordination with OT Engineering teams

Qualification

Required

Bachelor's degree in Information Security, Information Technology, Computer Science, or a related field, or equivalent experience
0-2 years of experience in cybersecurity, Identity & Access Management, compliance, or risk-related roles (including internships or academic experience)
Familiarity with IAM concepts, access control processes, or audit/compliance activities
Exposure to or familiarity with security or compliance tools (e.g., IAM platforms, logging tools, or monitoring solutions)
Foundational understanding of cybersecurity frameworks or standards (e.g., NIST CSF, SOX ITGCs, CIS Controls)
Strong attention to detail, documentation skills, and willingness to learn
Effective communication and collaboration skills

Preferred

Internship or academic experience supporting IAM, IT audit, or compliance-related activities
Familiarity with identity governance, privileged access management (PAM), and change management controls
Exposure to Operational Technology or industrial environments preferred but not required
Entry-level security certifications (e.g., Security+, ISC2 CC, or similar)