BeyondTrust Password Safe Implementation & Delivery Engineer

Agility Human Resource Management Services; Dadri, Greater Noida; On-site; INR 900,000 - 1,300,000; Full time

Job summary

Agility Human Resource Management Services is seeking an experienced PAM specialist to design and deploy Password Safe solutions for large-scale environments. You will lead workshops, translate requirements into deployed architectures, and integrate with SIEM, ITSM, IAM/IGA, and CI/CD toolchains.

You will configure authentication, authorization, and secrets management, ensure least privilege, and guide migrations from legacy systems, with a focus on enterprise security and compliance.

Qualifications

• 10+ years of experience in IT infrastructure, systems administration, or information security.
• 5+ years of hands-on implementation experience with BeyondTrust Password Safe (or comparable PAM platforms).
• Lead full-lifecycle PAM implementations: discovery, architecture, install, configure, integrate, migrate, go-live.
• Strong knowledge of Windows Server and Linux administration, SQL Server, AD/LDAP, DNS and networking.
• Scripting ability for automation: PowerShell and/or Python.
• PAM/PASM concepts: vaulting, session management, rotation, Just-in-Time, Zero Standing Privilege.
• Experience integrating PAM with SIEM, ITSM, IAM/IGA, and DevOps/CI-CD toolchains.
• Exposure to BeyondTrust products (BeyondInsight, EPM, Remote Support, Privileged Remote Access) is a strong plus.
• Excellent client-facing communication; able to lead workshops and document technical details.
• Preferred Certifications (e.g., BeyondTrust Certifications, CISSP/CEH/ITIL).

Responsibilities

• Lead requirements-gathering and architecture design workshops with customer IT, security, and compliance stakeholders.
• Translate requirements into a deployed Password Safe architecture (single appliance, multi-node, HA/DR, or Cloud).
• Install and configure Password Safe and BeyondInsight on-premises or Password Safe (Cloud) tenants.
• Design and implement smart rules, discovery scans, onboarding workflows for privileged accounts and SSH keys.
• Credential & session management: rotation policies, checkout workflows, session monitoring, and termination controls.
• Implement Just-in-Time and adaptive access policies aligned to least privilege and ZSP principles.
• Configure Password Safe API and secrets management to remove hard-coded credentials from pipelines.
• Connect Password Safe with Active Directory/LDAP, SIEM, ITSM, IAM/IGA, and RPA tools; plan migrations.

Skills

PAM implementations

Windows & Linux admin

PowerShell / Python scripting

PAM/PASM concepts

SIEM/ITSM/IAM/CI-CD integrations

BeyondTrust product exposure

Client-facing communication

Certifications

Education

Bachelor's degree in Computer Science / Information Technology or equivalent

Tools

BeyondTrust Password Safe

BeyondInsight

Endpoint Privilege Management (EPM)

Job description

Role & responsibilities

Required Skills & Experience

10+ years of overall experience in IT infrastructure, systems administration, or information security, including 5+ years of hands-on implementation experience with BeyondTrust Password Safe (or comparable PAM platforms such as CyberArk, Delinea/Thycotic, or SailPoint).

• Proven experience leading full-lifecycle PAM implementations discovery workshops, architecture design, installation, configuration, integration, migration, and go-live support.
• Strong working knowledge of Windows Server and Linux administration, SQL Server, Active Directory/LDAP, DNS, and core networking concepts.
• Hands-on scripting ability (PowerShell and/or Python) for automation, API integration, and troubleshooting.
• Solid understanding of PAM/PASM concepts: credential vaulting, session management, password/SSH key rotation, Just-in-Time access, Zero Standing Privilege, and privilege elevation.
• Experience integrating PAM platforms with SIEM, ITSM, IAM/IGA, and DevOps/CI-CD toolchains.
• Exposure to complementary BeyondTrust products (BeyondInsight, Endpoint Privilege Management/EPM, Remote Support, Privileged Remote Access) is a strong plus.
• Excellent client-facing communication skills, with the ability to lead workshops, present to security/compliance stakeholders, and write clear technical documentation.
• Preferred Certifications

BeyondTrust Certified Implementation Engineer Password Safe (Advanced preferred).

• BeyondTrust Certified Administrator Password Safe.

Industry certifications such as CISSP, CEH, or ITIL Foundation are an advantage. Education

Bachelors degree in Computer Science, Information Technology, or a related field, or equivalent professional experience.

Preferred candidate profile

Key Responsibilities Solution Design & Deployment

• Lead requirements-gathering and architecture design workshops with customer IT, security, and compliance stakeholders; translate requirements into a sized, documented Password Safe deployment architecture (single appliance, multi-node, HA/DR, or Cloud).
• Install and configure Password Safe and the BeyondInsight platform on-premises (including on the UVM / U Series Appliance) or provision and configure Password Safe (Cloud) tenants.
• Design and implement smart rules, discovery scans, and onboarding workflows to bring privileged accounts, service accounts, SSH keys, and assets under management. Configuration & Integration
• Credential & session management: configure password/SSH key rotation policies, check-out/check-in workflows, session monitoring, recording, locking, and termination controls.
• Just-in-Time & adaptive access: implement time-, location-, and identity-based access policies and approval workflows aligned to least-privilege and Zero Standing Privilege principles.
• DevOps & application secrets: configure the Password Safe API and secrets management capabilities to remove hard-coded credentials from scripts, CI/CD pipelines, and application code.
• Integrations: connect Password Safe with Active Directory/LDAP, SIEM (Splunk, Sentinel, QRadar), ITSM (ServiceNow), IAM/IGA platforms (Entra ID, SailPoint), and RPA tools. Migration & Upgrades
• Plan and execute upgrades of existing Password Safe/BeyondInsight environments, and migrations from legacy UVM appliance hardware to current on-premises or Cloud architectures.
• Coordinate cutover, rollback, and decommissioning plans that minimize disruption to production privileged access workflows.