PAM Engineer (CyberArk)

Sanderson Government & Defence; Manchester; On-site; GBP 81,000 - 100,000; Full time

Job summary

Sanderson Government & Defence is seeking two PAM/EMP Engineers (CyberArk) to support a large, highly customised endpoint privilege management environment. The role is based onsite in Manchester, with 5 days on-site work and a 3-month contract.

You will work with security, packaging, and engineering teams to maintain, optimise and enhance the EPM estate, with opportunities to cross-train into BeyondTrust EPM.

Qualifications

• Extensive hands-on BeyondTrust EPM administration and engineering experience.
• Strong Windows endpoint security architecture knowledge.
• Experience creating, modifying and troubleshooting EPM policies.
• Experience supporting application packaging and software deployment.
• Knowledge of group policy, endpoint security, and deployment tools.

Responsibilities

• Administer, support, and maintain a highly customised BeyondTrust EPM platform.
• Design, implement, and manage privilege elevation, application control, and endpoint security policies.
• Collaborate with packaging and engineering teams for deployment and compatibility.
• Analyse requirements and define privilege management solutions.
• Troubleshoot complex EPM issues and maintain operational stability.
• Develop and deploy policy changes; onboard new applications to EPM.
• Investigate incidents related to privilege elevation and endpoint controls.
• Produce technical documentation, support procedures, and standards.
• Contribute to platform optimisation and continuous improvement initiatives.

Skills

BeyondTrust EPM administration

Windows endpoint security

Policy design & management

Application packaging & deployment

Troubleshooting & RCA

Documentation & comms

Independent working

Tools

BeyondTrust EPM

CyberArk Endpoint Privilege Manager

PowerShell

Job description

PAM/EMP Engineer (CyberArk)

Contract | 2 Positions Available

Location: Manchester (5 Days Onsite)

Rate: £440 - £540 per day Inside IR35

Duration: 3 months

About the Role

I'm actively searching for two experienced BeyondTrust Endpoint Privilege Management (EPM) Engineers to support a large-scale, highly customised endpoint privilege management environment within a secure enterprise setting.

This is an excellent opportunity for individuals with strong expertise in BeyondTrust EPM, endpoint security, application control, and privilege management. You will work closely with Application Packaging, Endpoint Engineering, and Security teams to ensure the ongoing operation, optimisation, and enhancement of a complex EPM estate.

Candidates with significant CyberArk Endpoint Privilege Manager experience who are interested in cross-training into BeyondTrust EPM are also encouraged to apply.

Key Responsibilities

• Administer, support, and maintain a highly customised BeyondTrust EPM platform.
• Design, implement, and manage policies covering privilege elevation, application control, allow-listing, and endpoint security.
• Collaborate with Application Packaging and Endpoint Engineering teams to support application deployment and compatibility.
• Analyse application requirements and define appropriate privilege management solutions.
• Troubleshoot complex endpoint privilege management and application control issues.
• Develop, test, and deploy policy changes while maintaining operational stability and security.
• Support the on-boarding of new applications into the EPM environment.
• Investigate and resolve incidents relating to privilege elevation, application execution, and endpoint security controls.
• Work closely with infrastructure, packaging, and security teams to ensure seamless service delivery.
• Produce and maintain technical documentation, support procedures, and operational standards.
• Contribute to continuous improvement initiatives and platform optimisation activities.

Essential Skills & Experience

• Extensive hands‑on experience with BeyondTrust Endpoint Privilege Management (EPM) administration and engineering.
• Strong understanding of Windows endpoint security architecture.
• Proven experience creating, modifying, and troubleshooting BeyondTrust EPM policies.
• Experience supporting application packaging and software deployment processes.
• Strong knowledge of:
  • Windows Desktop Operating Systems
  • Application Control
  • Privilege Elevation
  • Endpoint Security
  • Software Packaging and Deployment
  • Group Policy Administration
• Ability to analyse software requirements and design effective privilege management solutions.
• Experience supporting highly customised enterprise EPM environments.
• Excellent troubleshooting and root cause analysis skills.
• Experience working within secure, controlled, or highly regulated environments.
• Strong documentation and technical communication skills.
• Ability to work independently in a complex operational setting.

Desirable Skills

• Experience with CyberArk Endpoint Privilege Manager (EPM).
• Experience migrating between endpoint privilege management platforms.
• Knowledge of Microsoft Intune, MECM/SCCM, or similar endpoint management solutions.
• PowerShell scripting and automation experience.
• Experience supporting large-scale enterprise endpoint estates.
• Familiarity with ITIL-based operational environments.
• Experience working within secure facilities or restricted-access environments.

What's Required?

• Be eligible for BPSS clearance
• Be able to work 5 days per week onsite in Manchester or Inverness
• Be available to participate in a 24x7 support rota

Reasonable Adjustments

Respect and equality are core values to us. We are proud of the diverse and inclusive community we have built, and we welcome applications from people of all backgrounds and perspectives. Our success is driven by our people, united by the spirit of partnership to deliver the best resourcing solutions for our clients.

If you need any help or adjustments during the recruitment process for any reason, please let us know when you apply or talk to the recruiters directly so we can support you.