PAM Engineer (CyberArk / BeyondTrust)

Sanderson Government & Defence; Manchester; On-site; GBP 81,000 - 100,000; Full time

Job summary

Sanderson Government & Defence seeks two experienced BeyondTrust Endpoint Privilege Management Engineers in Manchester for a 3‑month contract. You will administer a highly customised EPM estate, design privilege policies, and work with security, packaging and endpoint teams to ensure stability and security.

The role requires strong BeyondTrust EPM expertise, Windows endpoint security know‑how, and the ability to operate in a regulated enterprise environment onsite five days a week.

Qualifications

• Extensive hands-on BeyondTrust EPM administration and engineering experience.
• Strong understanding of Windows endpoint security architecture.
• Proven ability to create, modify, and troubleshoot EPM policies.
• Experience supporting application packaging and software deployment processes.

Responsibilities

• Administer, support, and maintain a highly customised BeyondTrust EPM platform.
• Design, implement, and manage privilege elevation and application control policies.
• Collaborate with packaging and engineering teams for deployment compatibility.
• Analyse software requirements and define privilege management solutions.
• Troubleshoot complex EPM and application control issues.
• Develop, test, and deploy policy changes while maintaining security and stability.
• Onboard new applications into the EPM environment.
• Investigate incidents related to privilege elevation and endpoint security controls.
• Produce technical documentation and operational procedures.
• Contribute to continuous improvement and platform optimisation.

Skills

BeyondTrust EPM administration

Windows endpoint security

Policy design & management

Troubleshooting & root cause analysis

Documentation & communication

Tools

BeyondTrust EPM

CyberArk Endpoint Privilege Manager

Microsoft Intune / MECM

PowerShell

Job description

Contract | 2 Positions Available

Location: Manchester (5 Days Onsite)
Rate: £440 - £540 per day Inside IR35
Duration: 3 months

About the Role

I'm actively searching for two experienced BeyondTrust Endpoint Privilege Management (EPM) Engineers to support a large-scale, highly customised endpoint privilege management environment within a secure enterprise setting.

This is an excellent opportunity for individuals with strong expertise in BeyondTrust EPM, endpoint security, application control, and privilege management. You will work closely with Application Packaging, Endpoint Engineering, and Security teams to ensure the ongoing operation, optimisation, and enhancement of a complex EPM estate.

Candidates with significant CyberArk Endpoint Privilege Manager experience who are interested in cross‑training into BeyondTrust EPM are also encouraged to apply.

Key Responsibilities

• Administer, support, and maintain a highly customised BeyondTrust EPM platform.
• Design, implement, and manage policies covering privilege elevation, application control, allow‑listing, and endpoint security.
• Collaborate with Application Packaging and Endpoint Engineering teams to support application deployment and compatibility.
• Analyse application requirements and define appropriate privilege management solutions.
• Troubleshoot complex endpoint privilege management and application control issues.
• Develop, test, and deploy policy changes while maintaining operational stability and security.
• Support the on‑boarding of new applications into the EPM environment.
• Investigate and resolve incidents relating to privilege elevation, application execution, and endpoint security controls.
• Work closely with infrastructure, packaging, and security teams to ensure seamless service delivery.
• Produce and maintain technical documentation, support procedures, and operational standards.
• Contribute to continuous improvement initiatives and platform optimisation activities.

Essential Skills & Experience

• Extensive hands‑on experience with BeyondTrust Endpoint Privilege Management (EPM) administration and engineering.
• Strong understanding of Windows endpoint security architecture.
• Proven experience creating, modifying, and troubleshooting BeyondTrust EPM policies.
• Experience supporting application packaging and software deployment processes.
• Strong knowledge of:
  • Windows Desktop Operating Systems
  • Application Control
  • Privilege Elevation
  • Endpoint Security
  • Software Packaging and Deployment
  • Group Policy Administration
• Ability to analyse software requirements and design effective privilege management solutions.
• Experience supporting highly customised enterprise EPM environments.
• Excellent troubleshooting and root cause analysis skills.
• Experience working within secure, controlled, or highly regulated environments.
• Strong documentation and technical communication skills.
• Ability to work independently in a complex operational setting.

Desirable Skills

• Experience with CyberArk Endpoint Privilege Manager (EPM).
• Experience migrating between endpoint privilege management platforms.
• Knowledge of Microsoft Intune, MECM/SCCM, or similar endpoint management solutions.
• PowerShell scripting and automation experience.
• Experience supporting large‑scale enterprise endpoint estates.
• Familiarity with ITIL-based operational environments.
• Experience working within secure facilities or restricted-access environments.

What's Required?

• Be eligible for BPSS clearance
• Be able to work 5 days per week onsite in Manchester or Inverness
• Be available to participate in a 24x7 support rota

Reasonable Adjustments

Respect and equality are core values to us. We are proud of the diverse and inclusive community we have built, and we welcome applications from people of all backgrounds and perspectives. Our success is driven by our people, united by the spirit of partnership to deliver the best resourcing solutions for our clients.

If you need any help or adjustments during the recruitment process for any reason