PAM Operations & Platform Specialist

We are looking for a skilled PAM Operations & Platform Specialist to oversee the day-to-day stability, administration, and expansion of our enterprise privileged security posture. In this hands-on engineering role, you will maintain and optimize our CyberArk / Idira Privilege Cloud infrastructure while bridging operational maintenance with the deployment of new architectural blueprints.

Beyond maintaining the core vault environment, you will drive technical implementations for adjacent privileged access products, including Workforce Password Management (WPM), Endpoint Privilege Management (EPM), and Vendor PAM, ensuring compliant, frictionless, and secure access across the organization.

Key Responsibilities

• Daily Operations & Troubleshooting
• Maintain continuous operational health and availability of the PAM platform, managing proactive monitoring, service requests, and tier-2/tier-3 support escalations.
• Diagnose and resolve complex operational failures involving automated credential rotation, password reconciliation, safe permissions, session isolation, and directory synchronizations.
• Oversee connector server lifecycle management, including routine patching, version upgrades, SSL/TLS certificate renewals, disaster recovery provisioning, and automated health tracking.
• Platform Onboarding & Capability Rollout
• Provision and onboard target endpoints, elevated service identities, administrative accounts, platforms, and granular access control policies.
• Translate architecture blueprints into production-ready platform configurations, validating enhancements in lower environments before release.
• Support the expansion of peripheral privileged security modules, including EPM policies on endpoints, secure vendor remote access workflows, and corporate password vaults.
• Streamline platform workflows and maintenance tasks by writing automation scripts utilizing PowerShell, RESTful APIs, and CLI tooling.
• Governance, Resilience & Incident Management
• Lead technical triage during major access disruptions, perform detailed root-cause investigations, and participate in scheduled break-glass simulations and disaster recovery exercises.
• Compile and maintain operational runbooks, standard operating procedures (SOPs), audit evidence, and compliance documentation.
• Partner with cross-functional IT, Directory Services (AD/Entra ID), Infrastructure, and Cyber Defense squads to deliver coordinated security enhancements.

Candidate Profile & Qualifications

Essential Technical Skills & Experience

• 3-5 years of hands-on platform administration and operational support within CyberArk or Idira Privilege Cloud ecosystems.
• Deep operational fluency with core vault components: Central Policy Manager (CPM), Privileged Session Manager (PSM), safe design, session recording, and automated rotation logic.
• Proven experience standing up, debugging, and maintaining connector infrastructure across hybrid enterprise networks.
• Solid technical grounding in foundational infrastructure:
• Operating systems: Windows Server and Linux enterprise distributions.
• Directory and access services: Microsoft Active Directory, Microsoft Entra ID, Single Sign-On (SSO), and MFA integrations.
• Network fundamentals: Core routing, firewalls, certificates, and DNS resolution.
• Practical understanding of high-availability architectures, break-glass protocols, and disaster recovery procedures.
• Familiarity with ITIL frameworks, specifically Change, Incident, and Problem Management workflows.

Preferred & Differentiating Factors

• Experience administering integrated modules across the platform portfolio (EPM, WPM, Vendor Privileged Access).
• Background working in GxP-regulated environments (e.g., Pharmaceuticals, Life Sciences, or Healthcare), with practical knowledge of computer systems validation (CSV), qualification standards, and strict audit trails.
• Practical scripting capabilities in PowerShell or Python to interact with PAM REST APIs for mass onboarding and configuration automation.
• Experience integrating PAM telemetry with enterprise SIEM solutions and ticketing systems (ServiceNow).
• Active vendor certifications (such as CyberArk Certified Defender, Sentry, or equivalent credentials).