Security Engineer

Responsibilities:

• Design, deploy, and maintain CyberArk Privileged Access Management (PAM) solutions including Vault, CPM, PSM, PTA and Privilege Cloud for hybrid and cloud-native environments.
• Administer and optimise CyberArk Endpoint Privilege Manager (EPM) policies to enforce least privilege and application control on servers and end-user endpoints.
• Implement and manage CyberArk Privilege Cloud, including onboarding of accounts, proxy-based access, session recording, and periodic password rotation.
• Configure and support CyberArk Identity (IDaaS/SSO/MFA) integrations with enterprise applications, directories, and cloud platforms.
• Own end-to-end CyberArk infrastructure on AWS: sizing and deploying components, HA/DR design, backup and recovery, patching, and performance tuning.
• Integrate CyberArk with LDAP/AD, RADIUS, SMTP, SIEM/Syslog, ticketing tools, and other security platforms following best practices.
• Develop and maintain onboarding workflows, platforms, and policies for privileged accounts and secrets across on-prem, cloud, and SaaS workloads.
• Monitor, troubleshoot, and resolve complex issues in PAM/EPM/Privilege Cloud/Identity environments, including advanced PSM and CPM configurations.
• Collaborate with security architecture, IAM, cloud, and application teams to design secure privileged access patterns and controls.
• Produce and maintain technical documentation, runbooks, and diagrams for CyberArk solutions and related integrations.
• Support audits and compliance activities by providing reports, evidence of control effectiveness, and remediation plans for findings.

Requirements:

• Bachelor's degree in Computer Science, Information Security, Engineering, or a related discipline, or equivalent practical experience.
• 5-12 years total experience in information security with at least 5+ years dedicated to CyberArk PAM engineering.
• Strong hands-on experience with CyberArk components: Enterprise Password Vault (EPV), CPM, PSM, PTA, and Application Access Manager/Secrets management.
• Proven experience implementing and operating CyberArk Privilege Cloud in production, including migrations from on-prem PAM where applicable.
• Practical experience with CyberArk EPM: policy design, least-privilege enforcement, elevation rules, and endpoint hardening.
• Working knowledge of CyberArk Identity (SSO, MFA, lifecycle flows) and its integration with AD, Entra ID (Azure AD), and major SaaS apps.
• Strong AWS experience operating security or IAM-related workloads (EC2 RDS, networking, load balancers, security groups, IAM roles/policies) supporting CyberArk infrastructure.
• Familiarity with common operating systems (Windows, Linux/UNIX) and directory services (AD/LDAP) from a PAM perspective.
• Experience integrating CyberArk with SIEM/SOC, ITSM, and ticketing tools, and building monitoring and alerting around PAM/EPM services.
• Scripting skills (PowerShell, Python, or similar) for automation, bulk onboarding, health checks, and reporting.
• Solid understanding of identity security, least privilege, Just-In-Time (JIT), Zero Trust, and privileged threat detection concepts.
• Design and implement security controls for Non-Human Identities (NHIs), including service accounts, machine identities, API credentials, application secrets, certificates, and AI-enabled workloads.
• Partner with AI, Data, Platform, and Cloud Engineering teams to establish secure privileged access patterns for AI/ML platforms and agentic workflows.
• Implement controls to mitigate emerging threats associated with AI agents, including over-privileged access, credential abuse, unauthorised actions, and prompt-injection-induced privilege misuse.
• Leverage PAM telemetry, SIEM integrations, and AI/ML-driven monitoring solutions to detect abnormal privileged behaviour involving both human and non-human identities.

Good to have:

• Mandatory: CyberArk Sentry-level certification (e. g., CyberArk Sentry PAM / CyberArk Sentry Privilege Cloud / equivalent) or above.
• Experience implementing CyberArk Secrets Manager, Conjur, or machine identity security solutions at enterprise scale.
• Experience securing AI agents, Generative AI applications, AI-powered automation platforms, and agentic architectures.
• Experience designing governance and lifecycle management controls for Non-Human Identities (NHIs) across large enterprise environments.
• Expertise in Zero Standing Privilege (ZSP), Just-In-Time (JIT) access, and advanced privileged access workflows.
• Experience integrating CyberArk solutions into DevSecOps, CI/CD pipelines, Infrastructure-as-Code, containerised workloads, and cloud-native platforms.
• Familiarity with AWS Bedrock, Lambda, or other AI/ML platforms from a security and privileged access perspective.
• Experience leveraging behavioural analytics, AI-assisted security monitoring, and advanced threat detection capabilities.
• Knowledge of emerging AI security risks, including prompt injection attacks, autonomous agent privilege escalation, credential abuse, and secure AI governance practices.
• Proven ability to lead enterprise PAM transformation initiatives, cloud migrations, and modernisation programs.
• Strong stakeholder management, consulting, and technical leadership capabilities with the ability to influence architecture and security decisions across the organisation.