Manager, IT - Privileged Access Management

Heinz; Toronto; On-site; CAD 102,000 - 128,000; Full time

Job summary

A leading food manufacturer in Toronto is seeking a Manager, IT - Privileged Access Management. In this role, you'll lead the management of the PAM platform and drive automation and security across identity systems. The ideal candidate has over 5 years of experience in Identity Security and deep technical knowledge of CyberArk. This position offers a competitive salary along with outstanding benefits, including healthcare and wellness programs.

Benefits

Health coverage for employees and dependents

Paid Time Off

Wellbeing programs

Pension plan

Qualifications

• 5+ years leading PAM initiatives.
• Deep knowledge of CyberArk and Active Directory integrations.
• Proficient in scripting and automation.

Responsibilities

• Lead management of the enterprise PAM platform.
• Define and implement PAM policies and controls.
• Develop automation scripts for streamlined processes.

Skills

Identity Security

Infrastructure Security

CyberArk

Scripting

Automation

Tools

CyberArk

PowerShell

REST API

Python

Active Directory

Job description

Overview

Job Description at Kraft Heinz. We grow our people to grow our business, with an industry-leading total rewards package that emphasizes a high discretionary bonus and benefits. Benefits begin immediately upon hire.

Manager, IT - Privileged Access Management at a glance... You will be a key technical leader responsible for the overall design, operations and modernization of the enterprise PAM ecosystem. You will blend strategic oversight with deep technical execution – driving continuous improvement, automation and integration across CyberArk, Active Directory, Entra ID and related identity security platforms. You will collaborate with internal teams and external partners to strengthen privileged account governance, enforce least privilege models and ensure operational excellence across hybrid and cloud environments.

Responsibilities

• Lead the end-to-end management of the enterprise PAM platform (CyberArk, Alero, etc.), ensuring secure onboarding, vaulting and lifecycle management of privileged credentials.
• Define, implement and continuously refine PAM policies, workflows and controls aligned with enterprise IAM standards and Zero Trust principles.
• Conduct regular assessments to identify privileged account risks and misconfigurations and drive remediation through automation or process redesign.
• Oversee integration of PAM with Active Directory, Entra ID, SIEM, EDR and ITSM tools to enable end-to-end visibility and enforcement of least privilege.
• Manage PAM health, performance and upgrades, monitoring vault replication, session management, connectors and API integrations to ensure system reliability.
• Partner with architecture, security operations and infrastructure teams to embed PAM controls into DevOps pipelines, server builds and cloud workloads.
• Develop and maintain automation scripts (Python, REST API, PowerShell, etc.) to streamline onboarding, access review and reporting processes.
• Participate in audits, compliance reviews and incident response activities related to privileged access, providing detailed technical insights and evidence.
• Drive the future state PAM roadmap – including passwordless access, JIT privilege elevation and identity threat detection integrations.

Qualifications

• Progressive experience in Identity Security or Infrastructure Security with at least 5+ years leading PAM initiatives.
• Deep technical knowledge of CyberArk (Core PAS, CPM, PSM, PTA, CPM plug-ins, REST APIs and Alero), with strong understanding of Entra ID and AD integration.
• Proven experience implementing PAM for servers, applications, DevOps pipelines and cloud workloads.
• Strong understanding of privileged session management, vault architecture, API integrations and connector configurations.
• Proficiency in scripting and automation using PowerShell, REST API, Python or equivalent.
• Solid knowledge of identity security frameworks, least privilege enforcement and Zero Trust access models.
• Ability to communicate complex technical issues to non-technical stakeholders and drive alignment across teams.

Total Rewards and Benefits

Our Total Rewards philosophy is to provide a meaningful and flexible spectrum of programs that equitably support our diverse workforce and their families and complement Kraft Heinz’ strategy and values.

New Hire Base Salary Range: $102,100.00 - $127,600.00

Bonus: This position is eligible for a performance-based bonus as provided by the plan terms and governing documents.

The compensation offered will take into account internal equity and may vary depending on the candidate's geographic region, job-related knowledge, skills, and experience among other factors.

Benefits: Coverage for employees and their eligible dependents through affordable access to healthcare, protection, and saving for the future, with plans tailored to meet you and your family’s needs.

Wellbeing: We offer events, resources, and learning opportunities that support physical, social, emotional, and financial well-being for our employees and their families.

You’ll be able to participate in a variety of benefits and wellbeing programs that may vary by role, country, region, union status, and other employment status factors, for example:

• Physical - Medical, Prescription Drug, Dental, Vision, Screenings/Assessments
• Social - Paid Time Off, Company Holidays, Leave of Absence, Flexible Work Arrangements, Recognition, Training
• Emotional – Employee Family Assistance Program, Wellbeing Programs, Family Support Programs
• Financial - Savings/Pension, Life, Accidental Death & Dismemberment, Disability, Discounted Perks

Location(s): Chicago/Aon Center, Toronto - Queen's Quay - Headquarters

Equal Opportunity: Kraft Heinz is an Equal Opportunity Employer – Underrepresented Ethnic Minority Groups/Women/Veterans/Individuals with Disabilities/Sexual Orientation/Gender Identity and other protected classes. Applicants requiring accommodation in the job application process may contact [e-mail] for assistance.