IAM Engineer - PAM (Remote in the US)

We're looking for an IAM Engineer - PAM to design, implement, and optimize Privileged Access Management (PAM) solutions for our clients. This role is ideal for someone with a strong professional services or consulting background — you've worked across multiple client environments, managed competing priorities, and know how to translate business requirements into secure, scalable CyberArk architectures. This is a 100% remote position but applicants must be in the US to be considered.

Responsibilities

Lead end-to-end CyberArk implementations, upgrades, and migrations across diverse client environments (on-prem, hybrid, and cloud); Design and deploy core CyberArk components: Vault, CPM, PVWA, PSM, PSMP, and PTA; Conduct discovery workshops with client stakeholders to gather requirements and define PAM strategy and architecture; Develop and execute onboarding plans for privileged accounts (Windows, Unix/Linux, databases, network devices, cloud platforms); Integrate CyberArk with adjacent systems (SIEM, ITSM, IAM, ticketing tools, AD/LDAP) via REST APIs and connectors; Create platform configurations, custom connectors, and PSM plugins/recordings for non-standard target systems; Produce clear, client-ready documentation: solution designs, runbooks, architecture diagrams, and knowledge transfer materials; Manage project timelines, scope, and client communications, often across multiple concurrent engagements; Troubleshoot complex production issues and provide escalation support; Mentor junior engineers and contribute to internal methodology, accelerators, and best-practice playbooks; Stay current on CyberArk product roadmap, releases, and emerging PAM/identity security trends; Embraces emerging technologies, including AI tools, to work smarter, solve problems, and drive better business outcomes

Requirements

Must be based in the US to be considered; 5+ years of hands-on CyberArk experience, including at least 2+ years in a professional services, consulting, or systems integrator environment; Demonstrated experience leading or playing a key role in multiple full-lifecycle CyberArk implementations for different clients; Deep technical knowledge of CyberArk PAS suite (Vault, CPM, PVWA, PSM, PSMP, PTA/PTA-EPM); Experience with platform onboarding across varied target types (Windows, Unix/Linux, databases, network/security devices, cloud IAM); Strong scripting skills (PowerShell, Python, or similar) for automation and custom integrations; Familiarity with REST APIs and experience building or supporting CyberArk integrations; Excellent client-facing communication skills — comfortable presenting to both technical teams and executive stakeholders; Ability to manage ambiguity, shifting priorities, and multiple client engagements simultaneously; Strong documentation skills and attention to detail

Nice to have

CyberArk certifications (CDE, Sentry, Defender, or equivalent); Experience with CyberArk cloud offerings (Privilege Cloud, Identity Security Platform); Exposure to other IAM/PAM tools (BeyondTrust, Delinea, SailPoint, Okta) for comparative or migration context; Experience with DevOps/Secrets Manager use cases (CyberArk Conjur, AAM); Background in regulated industries (finance, healthcare, government) and associated compliance frameworks (SOX, HIPAA, PCI-DSS)

Benefits

Remote workforce primarily (U.S. based only, some travel may be required for certain positions, working on-site may be required for Federal positions); Group Medical Insurance options: Zero Deductible PPO Plan (GuidePoint pays 90% of the premium for employees and 70% for family plans) or High Deductible Health Plan with HSA (GuidePoint pays 100% of employees premiums and 75% for family plans; HSA contributions in 4 equal quarterly installments: $850 per EE annually / $1750 per family annually); Group Dental Insurance: GuidePoint pays 100% of premium for employees and 75% of family plans; 12 corporate holidays and Flexible Time Off (FTO) program; Healthy mobile phone and home internet allowance; Eligibility for retirement plan after 2 months at open enrollment; Pet Benefit Option