Role Overview- A senior PAM engineer who delivers hands-on privileged access implementations across CyberArk, Delinea, or BeyondTrust platforms for enterprise clients.
- Expected to own technical workstreams independently and contribute to PAM architecture discussions under the direction of a delivery lead.
Key Responsibilities- Deploy and configure PAM platform components: CyberArk (Vault, CPM, PVWA, PSM, PTA), Delinea (Secret Server, Privilege Manager), or BeyondTrust (Password Safe, Privilege Management).
- Onboard privileged accounts across Windows servers, Linux/Unix systems, network devices, databases, and cloud platforms.
- Configure CPM policies for automated credential rotation and build or customize PSM connectors for RDP, SSH, and application sessions.
- Implement session recording, dual-control workflows, and break-glass access procedures.
- Execute privileged account discovery and remediation of standing privilege across client environments.
- Design and document safe structures, platform configurations, and onboarding runbooks.
- Support integration of PAM platforms with Active Directory, Entra ID, SIEM tools, and ticketing systems (ServiceNow).
- Map PAM controls to compliance frameworks (NCA ECC, CIS Controls, ISO 27001) as required per engagement.
Required Qualifications- 4-6 years of IAM/security experience with a minimum of 3 years in direct, hands-on PAM platform delivery.
- Component-level configuration experience on at least one of: CyberArk, Delinea Secret Server, or BeyondTrust Password Safe.
- Demonstrated experience with privileged account onboarding, CPM policy configuration, and PSM session management.
- Strong understanding of Active Directory service accounts, local admin accounts, and least privilege principles.
- Ability to produce client-grade technical documentation and runbooks.
Preferred Qualifications- CyberArk Defender, Sentry, or Guardian certification; Delinea or BeyondTrust equivalent.
- Experience across more than one PAM platform.
- Exposure to cloud privileged access patterns (AWS IAM roles, Azure Managed Identities, JIT access).
