Principal Identity Security Engineer - Privileged Access Management (PAM)

Additional Location(s): US-MN-Arden Hills; US-MA-MarlboroughDiversity - Innovation - Caring - Global Collaboration - Winning Spirit - High PerformanceAt Boston Scientific, we’ll give you the opportunity to harness all that’s within you by working in teams of diverse and high-performing employees, tackling some of the most important health industry challenges. With access to the latest tools, information and training, we’ll help you in advancing your skills and career. Here, you’ll be supported in progressing – whatever your ambitions. About the role:Boston Scientific was recognized by Forbes as one of the Best Workplaces for Engineers in 2026, reflecting a culture where engineers do meaningful work.Boston Scientific was recognized as a Glassdoor Best Place to Work in 2026, ranking No. 15 on the Top 100 list, reflecting the culture our employees experience every day.At Boston Scientific, cybersecurity plays a critical role in protecting patients, safeguarding intellectual property, supporting regulatory compliance and maintaining manufacturing continuity while enabling innovative technologies that improve and save lives.We are seeking a Principal Identity Security Engineer specializing in Privileged Access Management (PAM) to provide advanced technical leadership in the architecture, engineering, security and resilience of enterprise privileged access and identity security capabilities.In this highly technical individual contributor role, you will serve as a subject matter expert in CyberArk and related identity security technologies, driving secure, scalable solutions across a complex global medical technology environment. You will influence technical strategy, establish engineering standards, lead complex initiatives and collaborate with cross-functional teams to strengthen identity security and operational resilience.The ideal candidate brings deep hands-on CyberArk expertise, strong enterprise security architecture experience and the ability to translate business, cybersecurity and regulatory requirements into practical engineering solutions. Success requires balancing security, patient safety, product quality, validated-system constraints and business continuity.Work model, sponsorship, relocation:At Boston Scientific, we value collaboration and synergy. This role follows a hybrid work model requiring employees to be in our local office at least three days per week. Boston Scientific will not offer sponsorship or take over sponsorship of an employment visa for this position at this time. Relocation assistance is not available for this position at this time.Your responsibilities will include:Provide principal-level technical leadership for enterprise Privileged Access Management (PAM), identity security architecture and privileged identity resilience.Design and implement secure, scalable PAM architectures, engineering standards, technical controls and modernization solutions aligned with enterprise cybersecurity objectives.Serve as a technical subject matter expert for CyberArk, including privileged account management, session monitoring, credential rotation, secrets management, remote access and related identity security capabilities.Lead complex CyberArk engineering initiatives involving platform integration, upgrades, performance optimization, high availability, disaster recovery and operational resilience.Develop secure privileged access patterns for administrators, service accounts, application identities, vendors, cloud workloads, databases, network devices and other critical enterprise systems.Evaluate and recommend complementary identity security technologies, including BeyondTrust, Delinea, Microsoft Entra Privileged Identity Management, HashiCorp Vault and other emerging platforms.Design and advance Zero Trust security controls, least-privilege access, just-in-time access, zero standing privilege and privileged identity threat detection capabilities.Strengthen security controls for human and non-human identities, including service accounts, machine identities, application identities and emerging AI-agent identities.Integrate PAM capabilities with identity governance, Active Directory, Microsoft Entra ID, cloud platforms, security operations, monitoring and enterprise technology services.Develop privileged access solutions for manufacturing and operational technology (OT) environments, including industrial control systems, manufacturing execution systems, laboratories and validated systems.Partner with Manufacturing, Quality, Infrastructure and Cybersecurity teams to implement security controls while minimizing production disruption, operational risk and regulatory impact.Design compensating controls, secure vendor-access solutions and phased remediation approaches for legacy systems and environments with technical or validation constraints.Translate applicable regulatory, audit and security requirements into practical technical controls, engineering standards and supporting documentation.Apply relevant cybersecurity and regulatory frameworks, including FDA requirements, ISO 13485, IEC 62443, NIST Cybersecurity Framework and other applicable standards.Develop and validate privileged access recovery, emergency-access and break-glass solutions to strengthen enterprise cyber resilience and business continuity.Provide technical expertise during significant security incidents, risk assessments, vulnerability remediation, control testing and recovery exercises.Establish technical health indicators and security metrics to evaluate platform effectiveness, control adoption, resilience and risk reduction.Troubleshoot complex identity security issues, perform root-cause analysis and implement sustainable engineering improvements.Collaborate with enterprise architects, cybersecurity leaders, infrastructure engineers, cloud teams and business stakeholders to align identity security solutions with enterprise requirements.Mentor engineers, contribute to architecture reviews, promote engineering best practices and influence technical decisions across global teams.Evaluate emerging identity security technologies, threats and industry practices to recommend improvements to enterprise security capabilities.Required qualifications:Bachelor's degree in cybersecurity, computer science, engineering, information technology or a related discipline, or equivalent practical experience.Minimum of 8 years' experience in cybersecurity engineering, identity security, security architecture, infrastructure security or a closely related technical discipline.Minimum of 5 years' experience designing, implementing, integrating or supporting enterprise Privileged Access Management solutions.Deep hands-on expertise with CyberArk, including privileged account management, credential management, session monitoring, platform integration and security architecture.Strong knowledge of PAM architecture, identity security principles, privileged access controls and secure authentication technologies.Experience designing and implementing enterprise-scale identity security solutions across on-premises, cloud and hybrid environments.Demonstrated experience leading complex technical projects, developing engineering standards and influencing enterprise architecture decisions.Strong understanding of Zero Trust, least privilege, privileged identity security, service account management and secrets management.Experience implementing security controls, improving platform resilience and addressing vulnerabilities or operational risks in critical enterprise environments.Experience collaborating with cross-functional technology, cybersecurity and business teams to deliver complex security solutions.Strong analytical, troubleshooting, technical documentation and communication skills, with the ability to explain complex security concepts to technical and nontechnical stakeholders.Preferred qualifications:Experience working in a large, global or highly regulated enterprise, particularly in medical devices, health care, life sciences, pharmaceuticals or manufacturing.Experience leading enterprise PAM implementations, CyberArk modernization initiatives or privileged access recovery programs.Working knowledge of BeyondTrust, Delinea, Microsoft Entra Privileged Identity Management, HashiCorp Vault, One Identity or comparable identity security technologies.Experience securing manufacturing, operational technology, industrial control systems or validated environments.Knowledge of non-human identity security, service account governance, secrets management, machine identity controls and cloud privilege management.Familiarity with applicable regulatory and security frameworks, including FDA 21 CFR Part 11, ISO 13485, IEC 62443, NIST SP 800-53, SOX and HIPAA, where applicable.Experience designing high-availability architectures, disaster recovery solutions and secure emergency-access processes for critical identity platforms.Experience mentoring engineers, contributing to technical communities or establishing engineering best practices.Relevant professional certifications, including CyberArk, Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Cloud Security Professional (CCSP), GIAC or comparable Microsoft or cloud security certifications.Requisition ID: 637096Minimum Salary: $ 102100Maximum Salary: $ 194000The anticipated compensation listed above and the value of core and optional employee benefits offered by Boston Scientific (BSC) – see will vary based on actual location of the position and other pertinent factors considered in determining actual compensation for the role. Compensation will be commensurate with demonstrable level of experience and training, pertinent education including licensure and certifications, among other relevant business or organizational needs. At BSC, it is not typical for an individual to be hired near the bottom or top of the anticipated salary range listed above.Compensation for non-exempt (hourly), non-sales roles may also include variable compensation from time to time (e.g., any overtime and shift differential) and annual bonus target (subject to plan eligibility and other requirements).Compensation for exempt, non-sales roles may also include variable compensation, i.e., annual bonus target and long-term incentives (subject to plan eligibility and other requirements).For MA positions: It is unlawful to require or administer a lie detector test for employment. Violators are subject to criminal penalties and civil liability.Boston Scientific transforms lives through innovative medical technologies that improve the health of patients around the world. As a global medical technology leader for more than 45 years, we advance science for life by providing a broad range of high-performance solutions that address unmet patient needs and reduce the cost of healthcare. Our portfolio of devices and therapies helps physicians diagnose and treat complex cardiovascular, respiratory, digestive, oncological, neurological and urological diseases and conditions. Learn more at  and follow us on LinkedIn.Boston Scientific Corporation has been and will continue to be an equal opportunity employer. To ensure full implementation of its equal employment policy, the Company will continue to take steps to assure that recruitment, hiring, assignment, promotion, compensation, and all other personnel decisions are made and administered without regard to race, religion, color, national origin, citizenship, sex, sexual orientation, gender identity, gender expression, veteran status, age, mental or physical disability, genetic information or any other protected class.Please be advised that certain US based positions, including without limitation field sales and service positions that call on hospitals and/or health care centers, require acceptable proof of COVID-19 vaccination status. Candidates will be notified during the interview and selection process if the role(s) for which they have applied require proof of vaccination as a condition of employment. Boston Scientific continues to evaluate its policies and protocols regarding the COVID-19 vaccine and will comply with all applicable state and federal law and healthcare credentialing requirements. As employees of the Company, you will be expected to meet the ongoing requirements for your roles, including any new requirements, should the Company’s policies or protocols change with regard to COVID-19 vaccination.Among other requirements, Boston Scientific maintains specific prohibited substance test requirements for safety-sensitive positions. This role is deemed safety-sensitive and, as such, candidates will be subject to a prohibited substance test as a requirement. The goal of the prohibited substance testing is to increase workplace safety in compliance with the applicable law.