PAM - CyberArk / Delinea / BeyondTrust Engineer

Role OverviewA senior PAM engineer who delivers hands-on privileged access implementations across CyberArk, Delinea, or BeyondTrust platforms for enterprise clients.Expected to own technical workstreams independently and contribute to PAM architecture discussions under the direction of a delivery lead.Key ResponsibilitiesDeploy and configure PAM platform components: CyberArk (Vault, CPM, PVWA, PSM, PTA), Delinea (Secret Server, Privilege Manager), or BeyondTrust (Password Safe, Privilege Management).Onboard privileged accounts across Windows servers, Linux/Unix systems, network devices, databases, and cloud platforms.Configure CPM policies for automated credential rotation and build or customize PSM connectors for RDP, SSH, and application sessions.Implement session recording, dual-control workflows, and break-glass access procedures.Execute privileged account discovery and remediation of standing privilege across client environments.Design and document safe structures, platform configurations, and onboarding runbooks.Support integration of PAM platforms with Active Directory, Entra ID, SIEM tools, and ticketing systems (ServiceNow).Map PAM controls to compliance frameworks (NCA ECC, CIS Controls, ISO 27001) as required per engagement.Required Qualifications4-6 years of IAM/security experience with a minimum of 3 years in direct, hands-on PAM platform delivery.Component-level configuration experience on at least one of: CyberArk, Delinea Secret Server, or BeyondTrust Password Safe.Demonstrated experience with privileged account onboarding, CPM policy configuration, and PSM session management.Strong understanding of Active Directory service accounts, local admin accounts, and least privilege principles.Ability to produce client-grade technical documentation and runbooks.Preferred QualificationsCyberArk Defender, Sentry, or Guardian certification; Delinea or BeyondTrust equivalent.Experience across more than one PAM platform.Exposure to cloud privileged access patterns (AWS IAM roles, Azure Managed Identities, JIT access).