Senior CyberArk PAM Architect — Vault Migration Lead

Consult; Reading; Hybrid; GBP 110,000 - 160,000; Full time

Job summary

Consult seeks an senior CyberArk architect to lead identity and access management transformations in Reading or Newbury. You will design end-to-end vault migrations, manage phased cutovers, and ensure secure, auditable changes across on-prem and cloud deployments.

Responsibilities include federation design to Entra ID, MFA migrations, and governance across regulatory environments. You will mentor engineers and liaise with executives to drive secure PAM programs.

Qualifications

• 15+ years in Identity and Access Management, CyberArk PAM architecture.
• Deep hands-on knowledge of CyberArk EPV, PVWA, CPM, PSM, AAM/CCP, Vault across on-prem and Privilege Cloud deployments.
• Proven experience migrating CyberArk versions enterprise-scale (v10/v11/v12 to v13/v14).
• Strong working knowledge of SAML 2.0 and OIDC federation design with enterprise IdP integrations.
• Experience with credential provider architectures (CP, CCP) and on-boarding 100+ applications.
• Familiarity with MFA migration projects (RSA SecurID to cloud MFA/CA).
• Experience in regulated environments with change control and audit evidence requirements.
• Strong client-facing communication and executive-level presentations.

Responsibilities

• Design end-to-end migration architecture for CyberArk Vault, including extraction, transformation and staged loading.
• Define staged-ingestion model with disabled import → CPM soft-verification → dual-run mirroring → cutover rotation.
• Produce migration runbooks, RAID logs, and effort-sizing models across Safes, Accounts, Platforms, and Policies.
• Lead discovery to segment dependent applications by integration pattern (CP agent, CCP, Conjur, direct SSO).
• Design CP/CCP re-onboarding, AppID re-provisioning and certificate re-issuance.
• Define rollback and dual-run strategy with read-only fallback on source vault.
• Design PVWA federation to Entra ID via SAML/OIDC with claims mapping.
• Architect MFA migration from RSA SecurID to Entra MFA with CA policies.
• Ensure governance and audit evidence for TSA compliance reporting, and mentor CyberArk engineers.

Skills

CyberArk PAM architecture

Identity & Access Management

CyberArk components

Enterprise migration

SAML 2.0 & OIDC

Entra ID federation

App onboarding at scale

MFA migration

Regulated environments

Stakeholder communication

Tools

CyberArk EPV

PVWA

CPM

PSM

AAM/CCP

Vault architecture

SAML/OIDC federation

Entra ID/Okta

MFA tooling

Hydden (identity discovery)

Job description

Consult seeks an senior CyberArk architect to lead identity and access management transformations in Reading or Newbury. You will design end-to-end vault migrations, manage phased cutovers, and ensure secure, auditable changes across on-prem and cloud deployments.

Responsibilities include federation design to Entra ID, MFA migrations, and governance across regulatory environments. You will mentor engineers and liaise with executives to drive secure PAM programs.