Specialist – Identity & Privileged Access Management

CPX; Abu Dhabi Emirate; On-site; AED 180,000 - 240,000; Full time

Job summary

CPX is seeking a skilled Identity and PAM specialist to implement and operate access controls across Microsoft Entra ID, Active Directory, enterprise apps and cloud platforms. You will manage joiner/mover/leaver processes, provisioning, deprovisioning and orphan-account remediation, plus SSO, MFA and PIM governance.

You will implement and validate risk controls, support access reviews, and ensure secure credential management and session controls across diverse environments.

Qualifications

• 5+ years of information-security or identity-security experience, including hands-on IAM/IGA administration.
• Experience supporting PAM operations or engineering.
• Experience with configuring and operating IAM/PAM solutions in cloud and on-prem environments.

Responsibilities

• Operate joiner, mover and leaver controls, provisioning and deprovisioning.
• Configure and support SSO and federation through SAML, OAuth 2.0, OpenID Connect and SCIM.
• Administer MFA, authentication strengths, passwordless methods, Conditional Access and Identity Protection.
• Support access requests, RBAC/ABAC, segregation of duties, entitlements and access reviews.
• Onboard privileged accounts into PAM and administer vaulting, credential rotation, approvals, JIT access and session controls.
• Operate Microsoft Entra PIM for directory and Azure roles, including eligible assignments and activation controls.
• Govern service principals, managed identities, service accounts, certificates, secrets and API permissions.
• Maintain and test break-glass accounts and secure operating procedures.
• Investigate risky sign-ins, token misuse, privilege escalation and anomalous privileged sessions.
• Maintain IAM/PAM evidence, metrics, runbooks and remediation tracking.

Skills

Microsoft Entra ID

Active Directory

MFA

PIM

PAM

SCIM

SSO

Conditional Access

Identity Governance

PowerShell

Microsoft Graph

SIEM integration

Identity incident response

Education

Bachelor’s degree in Cybersecurity/Information Security/CS/IT

Tools

CyberArk

Delinea

BeyondTrust

One Identity

Sectona

Saviynt

NetIQ IGA

Job description

Implement and operate workforce, guest, vendor, privileged and non-human identity controls across Microsoft Entra ID, Active Directory, enterprise applications, cloud platforms and approved IAM/IGA/PAM technologies.

PRIMARY RESPONSIBILITIES

• Operate joiner, mover and leaver controls, provisioning, deprovisioning, reconciliation and orphan-account remediation.
• Configure and support SSO and federation through SAML, OAuth 2.0, OpenID Connect and SCIM.
• Administer MFA, authentication strengths, passwordless methods, Conditional Access, Identity Protection and session controls.
• Support access requests, RBAC/ABAC, segregation of duties, entitlements and access reviews.
• Onboard privileged accounts into PAM and administer vaulting, credential rotation, approvals, JIT access and session controls.
• Operate Microsoft Entra PIM for directory and Azure roles, including eligible assignments and activation controls.
• Govern service principals, managed identities, service accounts, certificates, secrets and API permissions.
• Maintain and test break-glass accounts and secure operating procedures.
• Investigate risky sign-ins, token misuse, privilege escalation and anomalous privileged sessions.
• Maintain IAM/PAM evidence, metrics, runbooks and remediation tracking.

JOB SPECIFICATIONS

Technical Skills

• Microsoft Entra ID, Active Directory, Conditional Access, MFA, PIM and Identity Governance.
• IAM/IGA lifecycle, SCIM, SSO, federation, access reviews, RBAC/ABAC and SoD.
• CyberArk, Delinea, BeyondTrust, One Identity, Sectona or equivalent PAM platform.
• PowerShell/Microsoft Graph, SIEM integration and identity incident response.

Certifications

• Preferred: SC-300 or current Microsoft identity equivalent.
• Preferred: recognized PAM product certification or formal administrator training.
• Preferred: Security+, SSCP, CISM, CISSP or equivalent.
• Preferred: CyberArk, SailPoint, Saviynt, NetIQ IGA, AZ-500 or ITIL Foundation.
• 5+ years of information-security or identity-security experience, including hands‑on IAM/IGA administration and at least 2 years supporting PAM operations or engineering.

Education

• Bachelor’s degree in Cybersecurity, Information Security, Computer Science, IT, Engineering or an equivalent discipline.