Software Engineer

NXP Semiconductors NV; Dadri; On-site; INR 2,000,000 - 4,000,000; Full time

Job summary

NXP Semiconductors NV is seeking an experienced L3 BeyondTrust Password Safe Engineer / PAM Specialist to lead the engineering, implementation, and advanced support of the PAM platform. You will partner with security, infrastructure, cloud, and identity teams to improve PAM coverage and reduce privileged-access risk across the enterprise.

You will design and optimize Password Safe, onboard accounts, automate onboarding, and provide L3 support with strong troubleshooting and remediation

Qualifications

• 7+ years of IT Security, Infrastructure, or IAM experience.
• 7+ years of PAM experience.
• 5+ years of recent hands-on BeyondTrust Password Safe engineering experience.

Responsibilities

• Design, configure, maintain, and optimize BeyondTrust Password Safe.
• Onboard privileged accounts and systems including Windows, Linux, databases, applications, network devices, and cloud platforms.
• Proactively discover privileged accounts, systems, service accounts, and other privileged identities across the enterprise.
• Identify unmanaged privileged accounts, PAM coverage gaps, control weaknesses, and configuration risks.
• Develop automation for onboarding, discovery, policy assignment, reporting, and other PAM activities.
• Serve as the technical escalation point for complex BeyondTrust issues and perform RCA when needed.

Skills

BeyondTrust Password Safe

PAM engineering

PowerShell

Python

REST APIs

Account Discovery

Onboarding Privileged Accounts

Session Management

Windows

Linux

Active Directory / Entra ID

Cloud (AWS/Azure)

Automation

Tools

BeyondTrust Password Safe

Job description

L3 BeyondTrust Password Safe Engineer / PAM Specialist

Job Summary

The L3 BeyondTrust Password Safe Engineer / PAM Specialist is responsible for the engineering, implementation, optimization, and advanced support of the enterprise BeyondTrust Privileged Access Management (PAM) platform. This role serves as a senior technical escalation point and is expected to proactively identify PAM coverage and control gaps, assess associated privileged-access risks, and drive technical remediation to closure. The engineer will work across security, infrastructure, cloud, application, and identity teams to improve PAM coverage and reduce privileged-access risk across the enterprise.

Key Responsibilities

PAM Engineering & Administration

• Design, configure, maintain, and optimize BeyondTrust Password Safe.
• Configure Managed Systems, Managed Accounts, Smart Rules, Access Policies, password rotation, discovery, and privileged session management.
• Support highly available and resilient Password Safe environments.
• Evaluate and implement platform improvements and new capabilities.

Discovery, Gap Assessment & Risk Remediation

• Proactively discover privileged accounts, systems, service accounts, and other privileged identities across the enterprise.
• Identify unmanaged privileged accounts, PAM coverage gaps, control weaknesses, and configuration risks.
• Assess and prioritize identified gaps based on security risk and business impact.
• Develop and execute remediation plans to reduce privileged-access risk.
• Drive identified PAM gaps through remediation and validate successful closure.
• Identify accounts or access paths bypassing PAM controls and recommend appropriate remediation or compensating controls.
• Track and improve PAM coverage, including discovered vs. managed privileged accounts and systems.

Account & System Onboarding

• Onboard privileged accounts and systems including Windows, Linux, databases, applications, network devices, cloud platforms, service accounts, and functional accounts.
• Troubleshoot complex onboarding issues and technical dependencies.
• Design appropriate password-management and rotation strategies for service and application accounts.
• Identify opportunities to streamline and automate onboarding.

Advanced Troubleshooting & L3 Support

• Serve as the technical escalation point for complex BeyondTrust issues.
• Perform Root Cause Analysis (RCA) and implement permanent corrective actions.
• Work with BeyondTrust Support on product-level issues when required.
• Troubleshoot:
  • Password rotation and reconciliation failures
  • Discovery and Smart Rule issues
  • Authentication and authorization failures
  • Session-management and recording issues
  • API and integration failuresPlatform performance, HA, and infrastructure issues

Integrations & Automation

• Integrate BeyondTrust Password Safe with Active Directory, Entra ID, LDAP, MFA, ServiceNow, SIEM platforms, databases, and cloud environments.
• Develop automation using PowerShell, Python, and BeyondTrust REST APIs.
• Automate account/system onboarding, discovery, policy assignment, reporting, and other repetitive PAM activities.
• Troubleshoot integrations end-to-end across BeyondTrust and dependent infrastructure.

Platform Upgrades & Resilience

• Plan and execute Password Safe upgrades, patches, and migrations.
• Perform compatibility and dependency assessments.
• Develop implementation, validation, rollback, backup, and recovery plans.
• Support and validate platform HA/DR capabilities.

Security, Risk & Compliance

• Implement PAM controls aligned with least privilege, Zero Trust, NIST, CIS, SOX, and internal security requirements.
• Support security assessments, audits, and PAM control testing.
• Identify privileged-access risks and drive technical remediation.
• Support management of PAM exceptions and compensating controls.

Documentation & Knowledge Transfer

• Maintain architecture diagrams, technical documentation, SOPs, troubleshooting guides, and operational/DR runbooks.
• Provide knowledge transfer and technical guidance to L1/L2 engineers.
• Contribute technical recommendations to the PAM roadmap and continuous improvement initiatives.

Required Technical Skills

BeyondTrust Password Safe

Strong hands-on experience with:

• Managed Systems and Managed Accounts
• Account/System Discovery
• Smart Rules
• Access Policies
• Password Rotation and Reconciliation
• Privileged Session Management and Recording
• Application and System Onboarding
• Service/Functional Account Management
• REST APIs
• Reporting and Auditing
• Platform troubleshooting and upgrades

Infrastructure & Identity

Strong working knowledge of:

• Windows and Linux
• Active Directory and Microsoft Entra ID
• LDAP/LDAPS
• DNS and PKI/Certificates
• Microsoft SQL Server
• Authentication and network connectivity concepts
• AWS/Azure environments

Automation

• PowerShell and/or Python
• REST APIs
• Experience automating PAM onboarding and operational activities

Experience Requirements

• 7+ years of IT Security, Infrastructure, or IAM experience.
• 7+ years of PAM experience.
• 5+ years of recent hands-on BeyondTrust Password Safe engineering experience.
• Experience supporting enterprise-scale PAM environments.Demonstrated experience with privileged-account discovery, onboarding, troubleshooting, and risk remediation.

Preferred Certifications

• BeyondTrust certifications relevant to Password Safe
• Relevant IAM, security, Microsoft, or cloud certifications are advantageous.

Key Expectation

This is a hands-on PAM engineering role, not primarily a coordination or ticket-management position. The successful candidate must be able to independently: Discover privileged access → Identify gaps → Assess risk → Remediate → Validate closure The objective is to continuously improve BeyondTrust coverage, platform reliability, automation, and the organization’s overall privileged-access security posture.