Who We Are
Boston Consulting Group partners with leaders in business and society to tackle their most important challenges and capture their greatest opportunities. BCG was the pioneer in business strategy when it was founded in 1963. Today, we help clients with total transformation-inspiring complex change, enabling organizations to grow, building competitive advantage, and driving bottom-line impact.
To succeed, organizations must blend digital and human capabilities. Our diverse, global teams bring deep industry and functional expertise and a range of perspectives to spark change. BCG delivers solutions through leading-edge management consulting along with technology and design, corporate and digital ventures—and business purpose. We work in a uniquely collaborative model across the firm and throughout all levels of the client organization, generating results that allow our clients to thrive.
What You'll Do
1. Lead ISPM Findings Triage (Heart of the Role)
Independently own and drive the triage of identity and entitlement data surfaced by BCG's ISPM system covering: Human identities
Non-human identities (service accounts, workloads, bots)
Privileged and highly sensitive access
Apply senior-level judgement to classify findings by: Criticality per BCG risk index
Acceptable vs. contextual risk vs. noise
Elimination of false positives using business context and identity risk scoring
Own prioritisation decisions based on risk impact, blast radius, and business alignment with full autonomy
2. Lead Identity Risk Interpretation & Contextualisation
Independently assess and determine justification for access including: Excessive privilege
Dormant but dangerous accounts
Toxic combinations
Lateral movement risk
Map findings to real attack paths, emerging threat patterns, and regulatory requirements
Translate graph-based insights into authoritative risk narratives for technical teams and executive stakeholders including CISO, CIO, CTO, and CRO
Shape BCG's identity risk strategy through programme-level recommendations with direct senior leadership visibility
3. Own Remediation Outcomes
Define and drive specific remediation actions including: Entitlement right-sizing
Privilege removal or restriction
Ownership reassignment
Policy or process refinement
Serve as the senior point of accountability for remediation progress across IAM, Cloud Security, Application Owners, and GRC
Influence IGA development roadmap based on findings and remediation patterns
Track items through closure and validate measurable, reportable risk reduction at enterprise scale
4. Own and Mature the Playbook Framework
Design, own, and continuously improve playbooks for: Privileged access risk
Non-human identity governance
Cloud-to-data access risks
Orphaned or over-permissioned identities
Set and own enterprise programme standards including: Severity thresholds and risk scoring methodology
Escalation criteria and cross-team engagement models
SLA expectations for remediation by risk tier
Lead ISPM policy tuning to continuously improve signal quality and reduce noise at enterprise scale
5. Serve as BCG's Senior Identity Security Subject Matter Expert
Act as the definitive internal authority on ISPM for the Cybersecurity function
Drive understanding of dashboards, risk trends, and identity exposure patterns across senior stakeholder teams
Lead audit and compliance responses with evidence-based, defensible explanations
Independently produce and own executive-ready reporting articulating: "What changed"
"Why it matters"
"What we are doing about it"
Proactively shape identity risk strategy by identifying programme gaps and driving improvements at senior leadership level
What You'll Bring
Must-Have
7-9 years of experience in IAM, cloud security, identity governance, or related security analytics
Deep expertise in:
Privileged access models and enterprise governance frameworks
Human vs. non-human identity risk scenarios
Entitlement and role-based risk analysis at enterprise…