Information and Communication Technology

Job Identification (Reference Number)**:16776**
Position Title**:Information and Communication Technology (ICT) Officer (Identity and Access Management) (UG)**
Duty Station City**:Valencia**
Duty Station Country**:Spain**
Grade**:UG**
Contract Type**:Special Short Term Ungraded (Up to 9 months)**
Recruiting Type**:Call for Applications**
Vacancy Type**:Special Vacancy Notice**
Initial duration **9 Months with Possibility of Renewal**
Closing date**:21 October 2025**

Introduction:
Established in 1951, IOM is a Related Organization of the United Nations, and as the leading UN agency in the field of migration, works closely with governmental, intergovernmental and non-governmental partners. IOM is dedicated to promoting humane and orderly migration for the benefit of all. It does so by providing services and advice to governments and migrants.

IOM is committed to ensuring a workplace where all employees can thrive professionally, while working towards harnessing the full potential of migration. Read more about IOM's workplace culture at IOM workplace culture | International Organization for Migration

Applications are welcome from first

Antigua and Barbuda, Bahamas, Barbados, Comoros, Congo (the), Cook Islands, Dominica, Federated States of Micronesia, Grenada, Guinea-Bissau, Holy See, Iceland, Israel, Kiribati, Lao People's Democratic Republic, Madagascar, Marshall Islands, Namibia, Nauru, Palau, Saint Kitts and Nevis, Saint Lucia, Samoa, Sao Tome and Principe, Solomon Islands, Suriname, Tonga, Tuvalu, Vanuatu

**Context**

The ICT Officer Identity and Access Management will lead own and evolve the identity and access management (IDAM) ecosystem. The role will be the gatekeeper for the digital identity landscape, ensuring the right people (and devices) get the right access, at the right time, for the right reasons.

The role will be responsible for the design, implementation, and support of the identity orchestration using One Identity - Identity Manager (IDM), integrated with Microsoft Active Directory, Azure Active Directory (Microsoft Entra ID), and HR-driven lifecycle events via the Oracle ERP (WAVE).

The ICT Officer (Identity and Access Management) must understand the art and science of automating access, enforcing least privilege, and reducing identity related risks.
Under the leadership of the Director of Information and Communications Technology (ICT) / Chief Information Officer and reporting directly to the Chief Technology Officer, the ICT Officer Identity and Access Management (IDAM) is responsible for the identity and access management function within ICT.

**RESPONSIBILITIES
IDENTITY AND ACCESS MANAGEMENT**
- Design, configure, and maintain One Identity - Identity Manager (IDM) for user lifecycle management, provisioning, and role-based access control.
- Integrate identity data from the WAVE ERP system to drive Joiner/Mover/Leaver (JML) processes.
- Manage synchronization and identity federation between Microsoft Active Directory and Azure Active Directory (Entra ID).
- Define and implement access governance, including role modelling, segregation of duties (SoD), and access review campaigns.
- Develop automated workflows for account provisioning, deprovisioning, and entitlement management across all ICT platforms.
- Collaborate with HR, Information Security, and Compliance teams to enforce identity related policies.
- Enforce Just-In-Time (JIT) access for sensitive operations.
- Monitor and respond to identity-related incidents and service requests.
- Create and maintain IAM documentation including architecture diagrams, SOPs, and audit records.
- Supervise the IAM team and conduct effective performance management and promote a cooperative work environment.

**MICROSOFT ACTIVE DIRECTORY AND ENTRA ID**
- Ensure correct operation of hybrid identity sync from AD to Entra ID via Azure AD Connect and monitor sync health and conflict resolution.
- Define entitlement management with access packages for joiners/movers/leavers.
- Enforce naming conventions and OU placement standards.
- Manage service accounts with lifecycle governance (preferably with expiration controls).
- Manage access using Azure AD roles, administrative units, and custom roles.
- Assign privileged roles via Privileged Identity Management (PIM) with time-bound or approval-based access.
- Define Conditional Access Policies based on risk, device, location, and user sensitivity.
- Enforce MFA using built-in Entra policies.
- Enable the publishing and management of SaaS apps using SAML, OAuth, or OIDC for Single Sign-On (SSO).
- Configure provisioning connectors to automate account creation in cloud apps.
- Build processes to enforce user consent restrictions to limit data exposure to risky apps.
- Create and maintain procedures for maintenance of security groups and distribution lists.
- Implement and enforce role-based access control (RBAC) through group nesting and inheritance.
- Periodically review and clean up stale groups and me