Lead Security Engineer (Privileged Access Management )

Overview

Lead the design, implementation and operation of enterprise Privileged Access Management (PAM) capabilities across on-premises, SaaS and multi-cloud environments, and provide technical leadership for the IAM PAM engineering function within the Identity Management team.

What you'll do

• Provide technical leadership for the IAM PAM engineering function, driving architecture, engineering standards, and operational excellence across privileged access solutions.
• Engage with technology leaders, business stakeholders, and cross-functional teams to drive the delivery of secure, scalable, and resilient solutions.
• Lead the design, implementation, and operationalization of privileged access management solutions, including enterprise vaults, secrets management, privileged session management, privileged endpoint controls, and Zero Standing Privileges (ZSP) workflows.
• Work within an agile environment to define requirements, prioritize work, manage technical dependencies, and ensure successful delivery of PAM capabilities.
• Develop and oversee automation, integrations, and self-service capabilities that improve security posture and operational efficiency.
• Troubleshoot complex PAM issues and serve as a technical escalation point, providing guidance to engineers, stakeholders, and partner teams.
• Analyze enterprise privileged access use cases and develop detailed technical requirements, governance frameworks, and operational support models.
• Drive adoption of security-by-design principles across cloud, infrastructure, and application platforms.
• Mentor and develop engineers through technical coaching, design reviews, knowledge sharing, and guidance on engineering best practices.
• Ensure the reliability and availability of mission-critical IAM systems and participate in the IAM On-Call rotation.
• Define, track, and communicate PAM metrics and key performance indicators to demonstrate risk reduction, operational maturity, and program effectiveness.

What you'll need

• Bachelor's or master's degree in computer science, Information Systems, Cybersecurity, or a related field.
• 6 to 8 years of experience in Identity and Access Management (IAM) and cybersecurity.
• Six or more years of experience implementing and operating enterprise PAM platforms such as CyberArk or similar solutions.
• Demonstrated experience leading the design and delivery of enterprise-scale PAM programs and complex security initiatives.
• Experience working with fast-paced operations and development teams; experience with DevOps practices is required.
• Knowledge of information security technologies, regulations, controls, and industry standards.
• Hands-on experience with enterprise PAM platforms, including credential vaulting, privileged session management, secrets management, and privileged access governance.
• Experience with Zero Standing Privilege (ZSP), Just-in-Time (JIT), and other modern privileged access management controls.
• Strong understanding of cloud IAM and PAM capabilities and familiarity with IaaS and PaaS architectures across AWS, Azure, GCP, and other enterprise cloud platforms.
• Experience developing automation and integrations using scripting languages such as Python, PowerShell, or similar technologies.
• Ability to build and deploy automation on cloud platforms, with familiarity in Infrastructure as Code (IaC) practices.
• Working knowledge of IAM services, LDAP, Active Directory, single sign-on (SSO), and federation protocols.
• Working knowledge of PKI fundamentals, certificate lifecycle management, and secrets management best practices.
• Experience defining technical requirements, engineering standards, governance models, and operational support processes.
• Proven ability to lead complex technical projects from solution design through implementation and operationalization.

Nice to have

• Familiarity with AI Agent Identity security concepts, including credential governance, delegated authorization, runtime access controls, and lifecycle management for autonomous and semi-autonomous AI systems.
• Experience securing non-human identities, including service accounts, workloads, APIs, automation platforms, and AI agents within enterprise PAM and Identity Security programs.
• Knowledge of machine identity authentication frameworks and standards, including SPIFFE/SPIRE and Zero Trust concepts.
• Relevant industry certifications such as CyberArk Defender/Sentry, CISSP, CCSP, Microsoft Certified: Azure Security Engineer Associate, AWS Certified Security - Specialty, or equivalent credentials.
• Experience working in highly regulated environments with stringent compliance, audit, and security requirements.

Details

• Hybrid work environment, working virtually when productive and getting together with colleagues in the office.
• Participation in the IAM On-Call rotation.