PAM Engineer

PAM Engineer

Hybrid in Cary, NC

Our client seeks a Privileged Access Management (PAM) Engineer to strengthen privileged access security across cloud, on-premises, and hybrid environments. You will engineer and support PAM solutions, reduce privileged-access risk, and advance Just-In-Time access, least privilege, and Zero Standing Privilege across the enterprise.

This is a full-time, permanent opportunity, offering a salary up to $130K plus 10% bonus, yearly equity awards and a comprehensive benefits package. Qualified applicants must be willing and able to work on a W2 basis.

Responsibilities

• Design, implement, and support enterprise PAM solutions across cloud, on-premises, and hybrid environments.
• Engineer privileged access capabilities including credential vaulting, password rotation, session management, privileged account onboarding, break-glass access, and account lifecycle management.
• Support Zero Standing Privilege (ZSP), Just-In-Time (JIT) access, least privilege, RBAC, and privileged access reduction initiatives.
• Secure privileged users, administrative accounts, service accounts, application identities, machine identities, and other non-human identities.
• Partner with infrastructure, cloud, application, and platform teams to onboard systems, applications, servers, databases, endpoints, and cloud resources into PAM platforms.
• Support Microsoft Entra ID capabilities including PIM, MFA, Conditional Access, and other access security controls.
• Develop and maintain privileged access standards, engineering runbooks, and operational procedures.
• Automate identity and privileged access processes using PowerShell, Python, REST APIs, workflow automation, and platform integrations.
• Troubleshoot PAM platform issues, perform root cause analysis, and implement corrective actions.
• Work with Security Operations and other teams to investigate privileged access risks, control gaps, and identity-related security incidents.
• Other duties as assigned.

Experience Requirements

• 3+ years of experience with PAM, IAM, or identity security solutions in large enterprise environments.
• 2+ years of hands-on experience administering CyberArk, BeyondTrust, Delinea, or an equivalent enterprise PAM platform. CyberArk is not required.
• Strong experience with credential vaulting, password rotation, privileged account onboarding, session management, and account lifecycle management.
• Experience with Zero Standing Privilege (ZSP), Just-In-Time (JIT) access, least privilege, RBAC, and break-glass access.
• Working knowledge of Microsoft Entra ID, PIM, MFA, Conditional Access, and Active Directory.
• Understanding of SSO, federation, authentication, and authorization technologies such as SAML, OAuth 2.0, OIDC, and LDAP.
• Experience with PowerShell, Python, REST APIs, or workflow automation is preferred.
• Ability to assess privileged access risks, identify control gaps, and recommend remediation.
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field, or equivalent experience.
• Approximately 5% travel may be required.