Diana Johnson | IAM and Governance Leader

The right people, the right access, and the evidence to prove it.

I'm Diana Johnson, an Identity and Access Management and governance leader with 15+ years across financial services and healthcare. I've led enterprise IGA migrations, onboarded 1,500+ applications into IAM services, and stood in the room with auditors and regulators.

Two ways to work together

Whether you need someone to lead your identity program for the long haul or an experienced hand for a migration, audit or cleanup, I bring the same combination of program delivery, operational leadership and compliance know-how.

Diana Johnson in a navy blazer and pink bow blouse

For employers

I'm looking for an IAM or identity governance leadership role where I can build and run the program, not just maintain it.

Led a global team of 15+ with ownership of hiring, workforce planning, performance and budgets
Consolidated five siloed onboarding teams into one centralized function
Directed IGA platform moves from Oracle Identity Manager to Saviynt to SailPoint IdentityIQ
Comfortable in front of EY, KPMG and NYDFS during audits and exams

See my experience

Diana Johnson in an ivory blazer and blush bow blouse

For consulting clients

I help organizations get their identity and access house in order, especially when an audit, a platform change or a growing backlog is on the horizon.

IGA platform selection, proof of concept and migration planning
Application onboarding programs that actually scale
Audit and regulatory exam readiness for access governance controls
Operating model, procedures and knowledge base for IAM teams

Start a conversation

What I can help with

Each of these comes straight from work I've led or delivered inside a large, regulated enterprise.

IGA platform migrations

Proof-of-concept evaluation, requirements, vendor management and initial onboarding of Active Directory, database, mainframe and Azure platforms.

Application onboarding at scale

Bringing applications into access requests and provisioning, SSO, MFA, segregation of duties, plain-language entitlements and certifications.

Audit and exam readiness

Preparing evidence, documenting controls and supporting auditor and regulator conversations so reviews of access governance go smoothly.

Access certifications and SoD

Designing certification campaigns and segregation-of-duties coverage that reviewers can understand and auditors can trust.

IAM operating model

Consolidating fragmented teams, reducing consultant dependency and setting up ServiceNow intake so work can be tracked and measured.

Risk, exceptions and compliance

Application risk classification and policy exceptions in Archer, aligned to SOX, ISO 27001 and SOC 1 requirements.

Experience

Apr 2018 – Oct 20268+ years

Vice President, Information Security Manager II

The Bank of New York Mellon

Helped develop an integrated IAM program from disconnected access-request and certification services, expanding governance capabilities through the Oracle Identity Manager-to-Saviynt transition and subsequent program development.
Led proof-of-concept evaluation and requirements definition for the Saviynt-to-SailPoint IdentityIQ migration, managed the vendor relationship, and directed initial onboarding of Active Directory, database, mainframe and Azure platforms.
Led a global IAM team of 15+ professionals across the US, APAC and EMEA, responsible for hiring, workforce planning, performance management, budgets and vendor relationships.
Consolidated five siloed IAM onboarding teams into a centralized function, helping eliminate $12M in annual consulting spend through consolidation and the move from Saviynt to SailPoint.
Directed onboarding of 1,500+ applications into IAM services spanning access requests and provisioning, SSO, MFA, SoD, plain-language entitlements and access certifications.
Supported internal and external audits and regulatory examinations involving EY, KPMG and NYDFS, presenting IAM documentation for reviews of access governance processes and controls.
Developed and standardized IAM procedures and maintained centralized knowledge resources for consistent execution.
Established ServiceNow incidents as the central channel for IAM end-user support, replacing distribution lists and Teams channels with trackable requests for workload reporting.
Coordinated return-to-office readiness for the Tennessee data center, inventorying 100+ workstations and creating employee seating and parking guidance.

Apr 2016 – Apr 20182 years

Health Care IT Compliance Business Analyst

Community Health Systems

Supported EHR Incentive Program compliance for a region of 20–30 clinics and hospitals, with additional support across all regions during shared attestation efforts.
Prepared and submitted EHR Incentive Program attestations, supporting $12M+ in federal incentive payments.
Guided clinicians through Meaningful Use requirements, captured supporting evidence and resolved missing documentation before submission.
Prepared CMS hardship exception and penalty reconsideration submissions that helped clinics and hospitals avoid or reverse $1M+ in Meaningful Use penalties.

Jun 2011 – Apr 20165 years

Information Security Program Manager

The Bank of New York Mellon

Led consolidation of enterprise IAM access request intake into Oracle Identity Manager Lifecycle Management and Remedy, retiring 60+ request mailboxes and about 20 fax lines.
Led development of a team knowledge management portal in RightAnswers, directing assignments and workloads for six business analysts.
Provided operational support to the IAM Managing Director and leadership team, including meeting documentation, budget tracking and confidential HR activities.
Supported Tennessee data-center site leadership through employee communications, vendor coordination, emergency drills and new hire onboarding logistics.
Supported audits and internal reviews by documenting IAM processes, collecting evidence and validating controls.

Core expertise

IAM strategy and governance Identity Governance and Administration (IGA) Identity lifecycle management Access request and provisioning Access certifications Segregation of Duties (SoD) Single Sign-On (SSO) Multifactor Authentication (MFA) IGA platform migrations Global team leadership Program and project management Application risk classification and policy exceptions Regulatory compliance and audit support

Tools and frameworks

Identity governance

SailPoint IdentityIQ, Saviynt, Oracle Identity Manager (OIM)

Service management

ServiceNow, Remedy

Project and knowledge management

Jira, Confluence, SharePoint, Smartsheet, Microsoft Project

Risk and exception management

Archer for application policy exceptions and issue tracking

Compliance frameworks

SOX, ISO 27001, SOC 1 for application classification and risk treatment

Education

Master of Science, Accounting and Information Systems

Middle Tennessee State University, concentration in Project Management

May 2010

Bachelor of Science, Business Administration

Troy University, concentration in Information Systems

December 2007