Senior Identity Security Engineer

For our U.S. applicants, CPKC; Calgary; On-site; CAD 140,000 - 190,000; Full time

Benefits offered by this job

Flexible benefits package

Pension plan

Employee share purchase plan

Performance incentive plan

Job summary

Canadian Pacific Railway Limited is seeking a Senior Specialist, Enterprise Security to lead CyberArk PAM, IAM, IGA, and PKI initiatives. The role focuses on securing privileged access, identity governance, and digital trust across on‑premises and cloud environments.

You will work with Windows, Linux, AD/Entra ID, and cloud directories, implement automation, and strengthen regulatory compliance within a dynamic rail network that connects North America.

Qualifications

• Minimum education aligned with cybersecurity or related field.
• 10+ years of cybersecurity/IAM/PAM/IGA/PKI experience.
• Experience administering CyberArk PAM in large enterprises.
• Hands‑on with IAM/IGA platforms and lifecycle management.
• Proficient in PowerShell, Python, REST APIs; strong security controls.

Responsibilities

• Administer, maintain, and optimize CyberArk PAM components.
• Design and troubleshoot CyberArk integrations with Windows, Linux, databases, cloud, directories, and apps.
• Support IAM capabilities: lifecycle, provisioning, authentication, MFA, SSO, and federation.
• Drive IGA initiatives: access reviews, RBAC/ABAC, joiner/mover/leaver, entitlements.
• Manage PKI services: CA lifecycle, SSL/TLS, key management, certificate issuance and revocation.
• Monitor incidents, perform root-cause analysis, and lead remediation.
• Ensure SOX/compliance requirements with audit-ready evidence and controls.
• Collaborate with security, infra, apps, and compliance teams.

Skills

CyberArk PAM

IAM

IGA

PKI

PowerShell

Python

REST APIs

SAML/OAuth/OpenID

RBAC & SOD

SOX Compliance

Education

High School Diploma or GED

Tools

Windows

Linux/UNIX

Active Directory

Entra ID / Azure AD

SailPoint

Saviynt

Okta

Job description

Join CPKC, North America’s first transnational railroad connecting U.S., Canada, and Mexico, where your career drives progress and safety is paramount. We connect communities, fuel economic growth, and provide meaningful work in a culture that values diversity, accountability, and pride. With opportunities for training, development, and advancement, you’re not just building a career—you’re part of something bigger. Together, we move goods, connect people, and create lasting change. Your future starts here.

PURPOSE OF THE POSITION:

As a Senior Specialist, Enterprise Security, you will be at the forefront of the organization's identity security strategy, helping protect critical systems through advanced CyberArk Privileged Access Management (PAM), Identity and Access Management (IAM), Identity Governance and Administration (IGA), and Public Key Infrastructure (PKI) capabilities. This role provides the opportunity to work with leading-edge cybersecurity technologies, influence enterprise security standards, and lead initiatives that strengthen regulatory compliance, operational resilience, and cyber defense. Your expertise will play a key role in securing privileged access, enhancing identity governance, managing digital trust through PKI, and enabling the business to operate confidently and securely in an evolving threat landscape.

POSITION ACCOUNTABILITIES:

• Administer, maintain, upgrade, and optimize the CyberArk PAM platform, including Vault, CPM, PSM, PWA, PTA, account onboarding, credential management, password rotation, privileged session management, just-in-time access, and privileged access workflows
• Design, support, and troubleshoot CyberArk integrations with Windows, Linux/UNIX, databases, network devices, cloud platforms, directory services, SaaS applications, and other enterprise technologies, including the development of custom connectors, scripts, APIs, and automation solutions
• Support enterprise IAM capabilities, including identity lifecycle management, provisioning, deprovisioning, authentication, authorization, federation, SSO, MFA, conditional access, and integration with Active Directory, Entra ID, LDAP, HR systems, cloud services, and business applications
• Drive Identity Governance and Administration (IGA) initiatives by supporting access request workflows, certifications, access reviews, RBAC, ABAC, segregation of duties, joiner-mover-leaver processes, entitlement management, role governance, and remediation of access-control risks
• Manage and support enterprise PKI services, including certificate authorities, certificate lifecycle management, issuance, renewal, deployment, monitoring, revocation, SSL/TLS troubleshooting, key management, and protection of cryptographic assets across on-premises and cloud environments
• Monitor, analyze, and resolve identity and access-related incidents, performing root cause analysis, vulnerability remediation, platform health monitoring, security reviews, and continuous improvement activities to strengthen the organization's security posture
• Support audit, compliance, and governance requirements by maintaining audit-ready documentation, evidence collection, reporting, control validation, SOX compliance activities, access certifications, privileged access reviews, and adherence to security frameworks and regulatory standards
• Collaborate with security, infrastructure, application, compliance, audit, and business teams to enhance PAM, IAM, IGA, and PKI programs, while maintaining technical documentation, runbooks, training materials, change management activities, disaster recovery processes, and awareness of emerging cybersecurity trends and best practices

POSITION REQUIREMENTS:

• Minimum High School Diploma or GED, OR an equivalent combination of education and relevant experience in Cybersecurity, Identity & Access Management (IAM), Privileged Access Management (PAM), Identity Governance (IGA), Public Key Infrastructure (PKI), or related technology disciplines
• 10+ years of experience in Cybersecurity, Identity & Access Management, Privileged Access Management, Identity Governance, or related security disciplines
• Experience administering CyberArk PAM solutions within large, complex enterprise environments
• Hands‑on experience with IAM and IGA platforms such as SailPoint, Saviynt, Microsoft Entra ID, Okta, Ping Identity, including identity lifecycle management, access provisioning, access certifications, RBAC, and segregation‑of‑duties controls
• Experience supporting PKI and certificate lifecycle management, including SSL/TLS certificates, Microsoft Certificate Services, public certificate authorities, cryptographic security controls, and identity integrations using Active Directory, Entra ID/Azure AD, LDAP, cloud platforms, applications, databases, and network devices
• Proficiency with PowerShell, Python, REST APIs, automation tools, authentication protocols (SAML, OAuth 2.0, OpenID Connect, Kerberos, RADIUS, SCIM), and experience supporting audit, compliance, and SOX requirements; industry certifications such as CyberArk Defender, CyberArk Sentry, CISSP, CISM, Security+, Microsoft Identity, SailPoint, or PKI‑related certifications are considered an asset

WHAT CPKC HAS TO OFFER:

• Flexible and competitive benefits package
• Competitive company pension and/or retirement plans
• Employee share purchase plan
• Performance incentive plan

PRE-EMPLOYMENT REQUIREMENTS:

Drug Testing

This position is subject to a negative company drug test.

• Criminal history check
• Education verification
• Professional references
• Social Security Number verification

BECOMING A RAILROADER:

As an employee with a North American presence, the possibility does exist that the location of your position may be changed based on organizational requirements.

Management Conductor Program

Becoming a qualified conductor or locomotive engineer is the single best way for a management employee to learn the business at CPKC. You may be required to obtain a certification or to maintain your current certification/qualification as a conductor or locomotive engineer.

CULTURE OF INCLUSION:

For our U.S. applicants, CPKC is an equal opportunity/affirmative action employer, inclusive of protected veterans and individuals with disabilities. For Canadian applicants CPKC is an employment equity employer committed to the principles of employment equity and inclusion. We encourage all qualified candidates to apply including: women, Black, Indigenous, People of Color (BIPOC), members of the LGBTQ+ community and people with disabilities. Accommodations for the job application process can be provided, as appropriate, upon request. All applicant information will be managed in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA).