Information Security Analyst

Location: Toronto, Canada or

Mt Laurel, NJ

3 days onsite

Job Description

Senior Information Security Analyst – Agentic AI Identity Governance

Role Summary: The Senior Information Security Analyst – Agentic AI Identity Governance will lead the design, implementation, and oversight of identity governance controls for autonomous and semi-autonomous AI agents operating across enterprise systems. This role focuses on ensuring that agentic AI systems are governed as non-human identities with clearly defined ownership, least-privilege access, auditable actions, lifecycle controls, and human accountability.

Key Responsibilities

• Establish and maintain identity governance standards for agentic AI systems, including registration, classification, ownership, entitlement management, and lifecycle governance for AI agents.
• Define access control models for AI agents based on least privilege, segregation of duties, just-in-time access, delegated authority, and policy-based authorization.
• Partner with Cybersecurity, IAM, AI Engineering, Risk, Privacy, Compliance, and Legal teams to ensure AI agents operate within approved enterprise guardrails.
• Develop governance processes for agent onboarding, approval, credential issuance, privilege assignment, access review, suspension, decommissioning, and emergency revocation.
• Assess risks associated with autonomous agent actions, tool use, memory, decision-making, system-to-system access, and privileged operations.
• Implement monitoring and audit requirements to ensure AI agent activity is observable, attributable, reviewable, and traceable to accountable business owners.
• Support the development of policies for human-in-the-loop oversight, accountability boundaries, escalation procedures, and exception handling.
• Conduct periodic access certifications, control testing, gap assessments, and maturity reviews for agentic AI identity governance capabilities.
• Contribute to threat modelling for AI agents, including identity misuse, privilege escalation, credential compromise, unauthorized tool invocation, data exposure, and autonomous policy violations.
• Prepare executive-ready reporting on control effectiveness, residual risk, remediation progress, and compliance posture related to agentic AI identities.

Required Qualifications

• 5+ years of experience in information security, identity and access management, security governance, risk management, or related cybersecurity roles.
• Strong understanding of identity governance and administration, privileged access management, access lifecycle management, authentication, authorization, and access certification processes.
• Experience designing or operating controls for non-human identities, service accounts, machine identities, APIs, bots, automation platforms, or AI-enabled systems.
• Knowledge of Zero Trust principles, least-privilege access, policy-based access control, and enterprise security architecture.
• Experience with risk assessment, control design, audit readiness, regulatory compliance, and security documentation.
• Ability to translate emerging technology risks into practical governance requirements, operating procedures, and executive-level communications.
• Excellent stakeholder management, analytical thinking, problem-solving, and written communication skills.

Preferred Qualifications

• Experience with AI governance, model risk management, responsible AI, data governance, or emerging technology risk programs.
• Familiarity with agentic AI concepts such as autonomous planning, tool invocation, memory, delegated authority, and multi-agent workflows.
• Hands-on experience with IAM platforms, IGA tooling, PAM solutions, SIEM/SOAR platforms, API security, cloud identity platforms, or security monitoring tools.
• Relevant certifications such as CISSP, CISM, CISA, CCSP, CRISC, Security+, or identity-focused certifications.
• Experience in highly regulated environments such as financial services, healthcare, government, or critical infrastructure. Technical and Governance Skills
• Identity governance for human, privileged, service, machine, and AI-agent identities
• Role-based, attribute-based, and policy-based access control models
• Privileged access management and just-in-time access patterns
• Security logging, auditability, identity analytics, and access anomaly detection
• AI agent risk assessment, control mapping, and governance framework development
• Security policy development, standard operating procedures, and control evidence management
• Cross-functional collaboration with AI engineering, enterprise architecture, cybersecurity operations, compliance, and risk teams

Success Measures

• AI agents are inventoried, classified, assigned accountable owners, and governed through approved lifecycle processes.
• Agentic AI access is provisioned according to least privilege, reviewed regularly, and revoked promptly when no longer required.
• High-risk AI agent actions are observable, logged, auditable, and mapped to accountable human oversight.
• Control gaps, policy exceptions, and residual risks are documented, prioritized, and remediated within agreed timelines.
• Stakeholders have clear, actionable reporting on Agentic AI identity governance posture, risks, and remediation progress.