Senior Manager - Identity & Access Management

Donaldson is committed to solving the world’s most complex filtration challenges. Together, we make cool things. As an established technology and innovation leader, we are continuously evolving to meet the filtration needs of our changing world. Join a culture of collaboration and innovation that matters and a chance to learn, effect change, and make meaningful contributions at work and in communities. ​

Position Summary

The Senior Manager, Identity & Access Management (IAM), based in Bloomington, MN, will lead the team that protects how every employee, contractor, partner, application, and machine across Donaldson’s global business gains and uses access. Identity is the new perimeter, and this leader will own the strategy, operations, and continuous improvement of our identity platforms, including SailPoint Identity Security Cloud and Microsoft Entra ID, across enterprise and manufacturing environments.

We are looking for a cybersecurity leader, not only an identity technologist: a hands-on doer who builds and develops a strong team, delivers results, and stays ahead of a rapidly changing field. This leader will strengthen compliance and audit readiness, reduce risk through Zero Trust and least privilege, and govern emerging identities such as AI agents, workload identities, and non-human accounts. Qualified candidates must be able to work a hybrid schedule at our  Bloomington, MN  office.

Role Responsibilities

- Lead, coach, and grow a high-performing team of IAM engineers and analysts, setting clear priorities, building technical depth and career paths, and creating a culture of ownership, accountability, and continuous learning.
- Own the IAM strategy and multi-year roadmap aligned with Donaldson’s cybersecurity program, Zero Trust architecture, business priorities, and regulatory and customer requirements.
- Lead the operation and evolution of SailPoint Identity Security Cloud for identity governance and administration, including joiner, mover, and leaver automation, role-based access, access requests, certifications, and separation-of-duties controls.
- Lead Microsoft Entra ID and the broader Microsoft identity stack, including single sign-on, conditional access, multi-factor and phishing-resistant authentication, Privileged Identity Management, and hybrid Active Directory.
- Strengthen privileged access management, least privilege, and just-in-time access for administrators, service accounts, cloud environments, and operational technology in manufacturing plants.
- Establish governance for non-human identities, including service principals, workload identities, API keys, bots, and AI agents, defining how they are provisioned, authorized, monitored, and retired.
- Drive compliance and audit readiness for SOX, TISAX, privacy, and customer requirements through effective controls, timely access reviews, clean evidence, and rapid remediation of findings.
- Partner with security operations to detect and respond to identity-based threats, such as credential theft, MFA fatigue attacks, and token abuse, using identity threat detection and response capabilities.
- Roll up your sleeves to lead critical integrations, platform upgrades, incident response, and complex troubleshooting, while partnering with HR, applications, infrastructure, and business leaders to simplify the user experience.
- Track and evaluate emerging identity trends and technologies, such as passwordless authentication, decentralized identity, AI-driven access analytics, and agentic AI controls, and turn them into practical, phased improvements with measurable outcomes.
- Own enterprise PKI and certificate lifecycle management, including secure issuance, renewal, revocation, automation, and governance of certificates and cryptographic identities.
- Ensure IAM controls support CMMC, DoD/CUI, SOX, TISAX, and other regulatory requirements, maintaining strong control effectiveness, audit readiness, and timely remediation.
- Drive identity lifecycle integration across authoritative sources and enterprise platforms, including HR systems, SailPoint, Oracle, cloud, SaaS, and other critical applications to strengthen joiner/mover/leaver automation and access governance.

Minimum Qualifications

- Bachelor’s degree in cybersecurity, computer science, information systems, or a related field, or an equivalent combination of education and relevant experience.
- 7+ years of experience in identity and access management or cybersecurity, including 3+ years leading teams of engineers or analysts.
- Hands-on experience implementing and operating SailPoint (Identity Security Cloud or IdentityIQ) and Microsoft Entra ID in a large, complex enterprise.
- Strong working knowledge of identity protocols and concepts, including SAML, OAuth 2.0, OpenID Connect, SCIM, Kerberos, role-based and attribute-based access control, and privileged access management.
- Proven experience supporting audits and regulatory compliance, including SOX access controls, user access reviews, and remediation of control findings.
- Travel - Up to 10%

Preferred Qualifications

- IAM leadership experience within global manufacturing, industrial technology, or a Fortune 500 enterprise.
- Experience with privileged access management platforms such as CyberArk, BeyondTrust, or Delinea, and with Microsoft Privileged Identity Management.
- Experience securing identities for cloud and SaaS platforms (Azure, AWS, Microsoft 365), workload identities, and integrations through APIs and connectors.
- Knowledge of identity threat detection and response, Microsoft Defender for Identity, and the attack techniques adversaries use against identity systems.
- Experience defining access controls for AI agents, copilots, and automation, including permissions, consent, data access boundaries, and auditability.
- Understanding of cybersecurity frameworks and standards such as NIST CSF, ISO 27001, CIS Controls, and Zero Trust architecture.
- Familiarity with access requirements in operational technology and manufacturing environments, including remote access for vendors and plant systems.
- Scripting and automation skills (for example PowerShell, Python, or Microsoft Graph API) and experience with infrastructure-as-code or DevSecOps practices.
- Relevant certifications such as CISSP, CISM, SailPoint Certified IdentityNow Engineer, Microsoft Certified: Identity and Access Administrator Associate, or CIDPRO.
- Excellent communicator who can explain identity risk in business terms, influence stakeholders, and build trust with auditors, executives, and end users alike.

Annual Salary Range: $148,880 - $186,100. Actual salaries will vary based on several factors including, but not limited to applicable work experience, training, education, performance.

This position is  eligible for annual incentive plan  based on performance and company growth.

Immigration Sponsorship Not Available:

- Applicants for this position must be currently and legally authorized to work in the United States without the need for current or future sponsorship (e.g., H-1B, J-1, F-1, CPT, OPT, etc.).
- Donaldson will not offer immigration sponsorship or assume sponsorship of an employment visa for this position.
- International relocation or remote work arrangements outside of the U.S. will not be considered.

Employment opportunities for positions in the United States may require use of information which is subject to the export control regulations of the United States. Hiring decisions for such positions are required by law to be made in compliance with these regulations. Applicants for employment opportunities in other countries must be able to meet the comparable export control requirements of that country and of the United States.

Donaldson Company has been made aware that there are several recruiting scams that are targeting job seekers.  These scams have attempted to solicit money for job applications and/or collect confidential information, Donaldson will never solicit money during the application or recruiting process.  Donaldson only accepts online applications through our Careers | Donaldson Company, Inc. website and any communication from a Donaldson recruiter would be sent using a donaldson.com email address.  If you have any questions about the legitimacy of an employment opportunity, please reach out to [email protected] to verify that the communication is from Donaldson.

Our policy is to provide equal employment opportunities to all qualified persons without regard to race, gender, color, disability, national origin, age, religion, union affiliation, sexual orientation, veteran status, citizenship, gender identity and/or expression, or other status protected by law.