Manager, Security Architecture and IAM

Skip to main content

You may choose to display a cookie banner on the external site. You must specify the message in the cookie banner and may add a link to a relevant policy. If you are unfamiliar with these requirements, please seek the advice of legal counsel.

What are cookies?

Cookies are simple text files that are stored on your computer or mobile device by a website's server. Each cookie is unique to your web browser. Some information that we collect about you is collected passively through the use of "cookies." Cookies are small files of information, which save and retrieve information about your visit to the Website - for example, how you entered and navigated our Website, and what information was of interest to you. We use this information to remember you when you return and to customize our Website to your preferences. It will contain some anonymous information such as a unique identifier, website's domain name, and some digits and numbers. We may use two types of cookies: (i) Session cookies; and (ii) Persistent Cookies. Session Cookies and Persistent Cookies are categorized as: (a) Strictly Necessary Cookies; (b) Performance and Functional Cookies; (c) Targeting Cookies and (d) Social Media Cookies.

What types of cookies do we use?

Necessary cookies

Necessary cookies allow us to offer you the best possible experience when accessing and navigating through our website and using its features. These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information. For example, these cookies let us recognize that you have created an account and have logged into that account. Strictly Necessary Cookies do not store any Personal Information.

Performance & Functional cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance. If you do not allow Performance Cookies we will not know when you have visited our site, and we will not be able to monitor its performance. (Examples: monitor website performance and collect anonymous data on how visitors use a website).

Targeting cookies

These cookies enable us and third-party services to collect aggregated data for statistical purposes on how our visitors use the website. These cookies do not contain personal information such as names and email addresses and are used to help us improve your user experience of the website. These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising. Examples include: Criteo, Google.

Social Media Cookies

These cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools. Examples include: Facebook, Instagram, Twitter).

How to delete cookies?

If you want to restrict or block the cookies that are set by our website, you can do so through your browser setting. Alternatively, you can visit www.internetcookies.com, which contains comprehensive information on how to do this on a wide variety of browsers and devices. You will find general information about cookies and details on how to delete cookies from your device.

Do not track signals

Currently, our systems do not recognize browser "do-not-track" requests. You may, however, disable certain tracking as discussed in the Cookies section (e.g., by disabling cookies). Please note that Hard Rock does not collect, and is not aware of third parties that collect, from users of the Website personal information about users' online activities across third party websites.

Clear GIFS, Pixel Tags and other technologies

Clear GIFs are tiny graphics with a unique identifier, similar in function to cookies. In contrast to cookies, which are stored on your computer's hard drive, clear GIFs are embedded invisibly on web pages. We may use clear GIFs (a.k.a. web beacons, web bugs or pixel tags), in connection with our Website to, among other things, track the activities of Website visitors, help us manage content, and compile statistics about Website usage. You may view and change your preferences at any time by using the 'Privacy Settings' link found in the footer of our website. We and our third party service providers also use clear GIFs in HTML e-mails to our customers, to help us track e-mail response rates, identify when our e-mails are viewed, and track whether our e-mails are forwarded.

Third party analytics and tracking

We use automated devices and applications, such as Google Analytics, to evaluate usage of our Site. We also may use other analytic means to evaluate our services. We use these tools to help us improve our services, performance and user experiences. These entities may use cookies, tracking pixels and other tracking technologies to perform their services. We do not share your personal information with these third parties.

Contacting us

If you have any questions about this policy or our use of cookies, please contact us at dataprotection@shrss.com.

Read Full Privacy Message

Decline

Accept Cookies

Sign In

Search for JobsStay Connected

Manager, Security Architecture and IAM page is loaded

Manager, Security Architecture and IAM

Apply

remote typeHybrid

locationsSupport Services Headquarters Building

time typeFull time

posted onPosted 2 Days Ago

job requisition idR13426

Our team members are the key to our company's success, and their health and well-being, as well as that of their families, is very important to us. We offer a comprehensive benefits package that allows our team members stay healthy, plan for their future and maintain a healthy work-life balance. Benefits may vary with employment status. To see our fill list of Team Member Benefits please visit our career site: www.gotoworkhappy.com/benefits

Job Description:

At Seminole Hard Rock Support Services, we're on a mission to protect our guests, team members, and enterprise assets through world-class cybersecurity practices. We are seeking a Manager of Identity & Access Management (IAM) and Automation to lead two strategic and deeply interconnected functions within the Cybersecurity & IT Governance organization. This role carries dual accountability: ownership of the enterprise IAM program and leadership of a centralized automation engineering capability that designs, builds, and delivers automation and integration solutions across the entire cybersecurity organization.

This is not a tool-administrator or playbook-configuration role. The Manager will lead engineers who develop production-grade automation, building APIs, engineering system integrations, designing event-driven workflows, and delivering scalable solutions that eliminate manual processes and accelerate security outcomes enterprise-wide. The ideal candidate is a technically deep leader who has architected automation at scale, understands modern development practices, and can credibly engage both engineers and executive stakeholders.

Scope of Leadership - Two Core Streams

STREAM 1 | Identity & Access Management Program

Program Strategy & Ownership

• Own the end-to-end enterprise IAM program: vision, roadmap, governance structure, budget, and executive reporting
• Define target-state IAM architecture and drive alignment across IT, HR, Legal, Compliance, and property leadership
• Manage program-level risks, milestones, and escalations; present program health and posture to the Risk Committee and senior leadership
• Ensure IAM controls and processes meet regulatory obligations including PCI-DSS, SOX, and gaming control board requirements

Identity Governance & Access Management

• Oversee the full identity lifecycle, provisioning, modification, de-provisioning, across all enterprise systems and business lines
• Establish and mature access governance frameworks: RBAC, segregation of duties (SoD), least privilege, and periodic access certification
• Lead selection, implementation, and management of IAM platforms spanning identity governance and administration, enterprise directory and federation, and privileged access management
• Drive PAM, SSO/federation, and MFA strategy across on-premise and cloud environments
• Partner with Internal Audit and Compliance on access reviews, evidence collection, and audit readiness

STREAM 2 | Automation Engineering & Integration

This stream is an engineering discipline, not a support function. The Manager leads a team of automation engineers responsible for designing and developing the integrations, pipelines, and workflows that power the cybersecurity organization. The team operates as an internal engineering practice with defined delivery standards, a product-style backlog, and accountability for uptime and quality of the solutions they build.

Automation Engineering Practice

• Build and lead an automation engineering team that develops, maintains, and evolves automation solutions as production-grade software, with version control, peer review, testing, and documentation
• Define the team''s operating model: intake process, backlog prioritization, sprint cadence, release standards, and SLA commitments for solution uptime and maintenance
• Establish a shared automation platform and toolchain, selecting technologies, setting coding standards, and ensuring reuse across projects rather than one-off scripts
• Champion API-first design and event-driven architecture principles across all automation development work
• Report on automation engineering output: solutions delivered, manual effort eliminated, integration coverage, and backlog health

Integration Development

• Lead the design and development of integrations between security tools, enterprise platforms (ITSM, SIEM, identity systems, HR, cloud), and third-party services, using REST APIs, GraphQL, webhooks, message queues, and middleware
• Architect bidirectional data flows and synchronization patterns across the security toolstack to eliminate silos and enable real-time data sharing
• Develop and maintain an integration catalog, documenting all active integrations, dependencies, data contracts, and refresh schedules
• Evaluate and manage integration platforms, middleware, and equivalent iPaaS solutions
• Ensure integration solutions are built with resilience in mind: error handling, retry logic, alerting, and rollback procedures

Workflow & Process Automation Development

• Translate manual, repetitive cybersecurity processes into automated, testable, and auditable workflows, spanning orchestration, conditional logic, approvals, and notifications
• Develop automation using a mix of low-code workflow platforms and code-first approaches (Python, PowerShell, Bash) based on complexity and maintainability requirements
• Build event-driven automation that responds in real time to signals from security tools, identity systems, cloud environments, and ticketing platforms
• Maintain a library of reusable automation components, connectors, and templates available to all cybersecurity teams

Engineering Standards & Governance

• Define and enforce software development lifecycle (SDLC) standards for automation code: source control (Git), peer review, CI/CD pipelines, environment promotion (dev/test/prod), and change management
• Ensure all automation is testable, documented, and transferable, no single points of failure or undocumented tribal knowledge
• Establish a process for regular review and deprecation of outdated automation to prevent technical debt accumulation
• Define and track engineering KPIs: deployment frequency, change failure rate, mean time to recovery, and automation coverage across cybersecurity processes

Required Qualifications

• 12+ years of experience in IT, cybersecurity, or software engineering - with at least 5 years in a senior leadership or director-level role
• Proven ownership of an enterprise IAM program including identity governance, PAM, SSO, and access lifecycle management
• Hands-on experience with enterprise IAM platforms: identity governance and administration, enterprise directory and federation, and privileged access management, or equivalents
• Demonstrated experience leading an automation engineering, integration engineering, or DevSecOps function, not just administering tools
• Strong proficiency in integration development: REST APIs, webhooks, event-driven architecture, and middleware/iPaaS platforms
• Coding proficiency in one or more languages used in automation engineering (Python, PowerShell, JavaScript/Node.js, or similar)
• Experience applying SDLC disciplines to automation work: source control, CI/CD, peer review, environment promotion, and documentation standards
• Ability to architect scalable, maintainable automation solutions, not just one-off scripts
• Excellent executive communication skills; able to articulate technical strategy and program health to risk committees and C-suite
• Familiarity with PCI-DSS, SOX, NIST CSF, and ISO 27001

Preferred Qualifications

• Experience in hospitality, gaming, or entertainment with complex, multi-property IT environments
• Background in platform engineering, shared services, or building internal developer/automation platforms
• Relevant certifications: CISSP, CISM, CIAM, vendor certifications in identity governance platforms, or certifications in enterprise integration platforms
• Experience with cloud-native automation and integration services (Azure Logic Apps, AWS Lambda/Step Functions, GCP Workflows)
• Familiarity with gaming regulatory compliance requirements

Why work here?

Thank you for choosing us as your employer of choice! If you are ready for an exciting opportunity working in a creative environment where you can bring your authentic self to work, we want to connect with you!

Get In Touch

If you''re unable to find a position that matches your interest, please tell us a little about yourself, and we''ll recommend jobs that match your interests.

Get Started

About Us

Be Iconic represents the roots of our culture.

The Seminole Tribe of Florida remains the only unconquered tribe in the United States of America. The Tribe established Seminole Gaming in 1979, when it opened the first high-stakes bingo hall in the United States. Building on its rich heritage of courageous and groundbreaking achievements, the Seminole Tribe of Florida acquired Hard Rock International in March 2007-the first transaction of its kind by a Native American tribe.

Today, Hard Rock International remains one of the most globally recognized companies in the world, with Hard Rock Hotel, Casino, Cafe and Rock Shop venues in over 74 countries. With the continued growth of Seminole Gaming and Hard Rock International, Seminole Hard Rock Support Services was created to support all of our brands and lines of business.

With the largest global footprint in the hospitality industry for over 50 years, our number-one job is to bring fun and excitement to our team members and our guests!

Read More

Follow Us

*

Privacy Policy

2026 Workday, Inc. All rights reserved.