PAM Engineer - AVP

Preferred candidate profile

Essential CyberArk PAM Platform Expertise

• Deep, hands-on knowledge of all core CyberArk modules: Vault, PVWA, CPM, PSM, PSMP, PTA, Central Credential Provider (CCP) and Credential Provider (CP), including architecture, hardening, HA/DR and upgrades.
• Working experience with Secure Web Sessions (SWS), Secure Cloud Access (SCA) and Endpoint Privilege Manager (EPM), including policy design and production rollout.
• Understanding of SPIFFE and CyberArk Secure Workload Access for workload identity, and of Secrets Manager/Conjur concepts for machine and application secrets.
• Extensive knowledge of CyberArk PAM capabilities protecting hybrid environments (on-premises, AWS, Azure), including self-hosted and Privilege Cloud models.
• Proven ability to develop and customise CPM plugins and PSM connectors.
• Strong Windows, Linux/Unix, database, cloud and application integration experience, including identification and onboarding of privileged accounts across all platforms.
• Proven experience across discovery, design, implementation and handover phases.
• Strong understanding of advanced PAM controls, PAM governance and privileged account lifecycle management, and of PAM processes and role definition alongside native access control mechanisms.

Essential – Automation, Integration and Troubleshooting

• Expert PowerShell scripting, with Python or shell scripting, to automate PAM operations.
• Hands-on CyberArk REST API integration experience (authentication, safes, accounts, platforms, reporting).
• Hands-on ServiceNow integration experience (ticket validation, request and approval workflows, MID Server and CMDB-driven onboarding).
• Structured troubleshooting of Vault, CPM, PSM, CCP/CP, EPM and integration issues using logs, traces and network/TLS analysis, with documented root cause analysis.
• Strong reporting and data analytics skills to evidence control effectiveness and track operational health.

Essential – Cybersecurity and IAM Fundamentals (candidate must demonstrate)

• Core cybersecurity principles: confidentiality, integrity and availability, least privilege, defence in depth, zero trust, and common credential-based attack techniques (credential theft, lateral movement, privilege escalation).
• IAM fundamentals: authentication versus authorisation, MFA, RBAC, joiner-mover-leaver lifecycle, segregation of duties, access certification, non-human identity governance, and how PAM fits with identity governance and access management.
• Identity and infrastructure protocols: Active Directory, LDAP, Kerberos, SAML, OAuth/OIDC, PKI/TLS, SSH and RDP, plus network basics (firewalls, load balancers).
• Familiarity with control frameworks and regulatory expectations for financial services (for example NIST, ISO 27001), and the ability to map PAM controls to audit evidence.
• Experience of Information Security and a solid IT background, with detailed knowledge of the Access Control and Privileged Access Management domains, including the tools, techniques and procedures used.

Essential – Professional Skills

• Excellent analytical and problem-solving skills, with the ability to engage senior stakeholders and technical teams.
• Strong communication skills (critical) and strong technical documentation skills, maintaining procedural documentation to international Quality Management standards.
• Experience in creating a detailed work breakdown structure for PAM implementation.
• Ability to work with multiple stakeholders from Security, Operations, Application Owners and Service Providers on deployment activities and on enhancing the PAM solution.
• An aptitude and interest for future innovations and technologies, and a willingness to continually learn and nurture those around you.

Desirable

• Experience migrating CyberArk PAM Self-Hosted to Privilege Cloud, and DevOps/CI-CD secrets management integration.
• Infrastructure-as-code and configuration management tooling (for example Terraform, Ansible) and Kubernetes workload identity experience.
• Experience with other PAM tools, and with identity governance platforms such as SailPoint.

Work Experience:

Essential:

• Experience in working on multiple projects with broad scope, ambiguity and a high degree of difficulty.
• Delivered enterprise-scale CyberArk implementations, upgrades or migrations in a regulated financial services or similarly controlled environment.
• Demonstrable experience running PAM at scale with automation, reducing manual effort through scripting, API integration and self-service workflows.
• Demonstrable proficiency in a wide range of IT security technologies and embedded security; at a minimum, knowledge must cover key cybersecurity domains such as Identity and Access Management and Incident Management, with a high level of analytical ability where problems are complex and require innovative solutions.
• Experience in technology projects such as cyber infrastructure implementation and replacement, and the ability to maintain a working knowledge of cybersecurity principles and elements.
• Understand global program structure, launch plan and timing, and global program ownership.
• Demonstrable experience of senior stakeholder management and relevant management reporting.
• Ability to coach team members through knowledge transfer and constructive feedback.