Security Engineer

FUJITSU ASIA PTE LTD; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

FUJITSU ASIA PTE LTD is seeking a Security Engineer to lead end-to-end implementation, integration, and operationalization of CyberArk PAM, Venafi, and MFA solutions. You will deploy, migrate, onboard, and integrate privileged access controls and machine identities, ensuring secure, scalable, and compliant PAM ecosystems across enterprise environments.

You will work with architects, PMs, and stakeholders to deliver secure PAM, CLM, and MFA solutions while adhering to security best practices and

Qualifications

• CyberArk CDE-PAM certification required.
• Hands-on deployment experience with EPV, CPM, PSM, PVWA, PTA, and MFA components.
• Strong knowledge of Windows Server, Linux, AD/LDAP, and networking.
• Scripting and IAM/security best practices knowledge.
• Experience in large-scale enterprise deployments preferred.

Responsibilities

• Deploy and harden CyberArk components across on-premises and cloud.
• Migrate, onboarding, and integration of privileged access controls and machine identities.
• Collaborate with architects and stakeholders to ensure secure PAM solutions.
• Implement Venafi TLS Protect platform and machine identity management.
• Provide L2/L3 troubleshooting and post-implementation support.

Skills

CDE-PAM certification

CyberArk deployment

Windows & Linux

Active Directory/LDAP

Scripting

IAM

Zero Trust

Security best practices

Tools

Venafi TLS Protect

RSA Authentication Manager

SecurEnvoy

Cisco Duo

ServiceNow

Splunk

QRadar

CyberArk Privilege Cloud Connector

Job description

The Security Engineer is mainly responsible for the end-to-end implementation, integration, and operationalizationof CyberArk (On-Prem and Cloud) Privileged Access Management (PAM), Venafi Machine Identity Management and 2FA (such as RSA, SecurEnvoy, Cisco Duo) solutions across enterprise environments. This role focuses ondeployment, migration, onboarding, and integrationof privileged access controls, certificates, and machine identities in line with security best practices.

The Security Engineer will work closely with architects, project managers, and customer stakeholders to deliversecure, scalable, and compliant PAM, CLM and 2FA solutions.

Key Responsibilities

1. CyberArk Deployment & Implementation

• Install, configure, and harden CyberArk components: Enterprise Password Vault (EPV)Central Policy Manager (CPM)Privileged Session Manager (PSM)Password Vault Web Access (PVWA)Privileged Threat Analytics (PTA)Privilege Cloud ConnectorCyberArk Adaptive Multi-Factor Authentication (MFA)CyberArk Vendor Privileged Access Manager (Vendor PAM)
• Install, configure 2FA solutions such as RSA, SecurEnvoy, Cisco Duo
• Develop and Maintain PSM and CPM connectors
• Execute full-cycle deployment activities: Infrastructure build Installation & configuration System validation and testing
• Ensure adherence to CyberArk as well as RSA/SecurEnvoy best practices for installation, configuration, and testing

2. Venafi Deployment & Machine Identity Management

• Install, configure, and administer Venafi TLS Protect platform.
• Design and document Venafi architecture.
• Configure machine identity lifecycle management.
• Implement: Certificate discovery Certificate inventory management Certificate automation workflowsCA integrations
• Enable: Automated certificate issuance Automated renewal Certificate revocation processes Self-service certificate requests
• Configure network discovery and certificate intelligence capabilities.
• Monitor certificate compliance and certificate expiry risks.

3. Migration & Upgrade Activities

• Perform CyberArk environment migrations (on-prem to on-prem / cloud / SaaS)
• Execute version upgrades and platform transitions (e.g., legacy OS to modern OS)
• Handle: Vault data migration Cutover planning and execution
• Support post-migration stabilization and user acceptance testing

4. Account Onboarding & Policy Management

• Onboard privileged accounts, systems, and applications into CyberArk
• Configure: Password policies Rotation and reconciliation settings Access controls and role-based permissions
• Define and implement operational procedures (e.g., break-glass access, onboarding workflows)

5. Integration with Enterprise Systems

• Integrate CyberArk with: SIEM, ITSM, IAM platforms Endpoint and network security tools
• Enable session recording, monitoring, and audit logging across systems

6. Integration & Automation

• Integrate CyberArk and Venafi with:
• Active Directory / LDAP
• Entra ID
• SIEM platforms
• Splunk
• QRadar
• ITSM platforms
• ServiceNow
• Identity and Access Management systems
• Security monitoring platforms
• Certificate Authorities
• Microsoft CA
• DigiCert
• Entrust
• GlobalSign

7. PAM Architecture & Design Support

• Support solution architects in: Gathering requirements
• Reviewing technical architecture
• Conducting technical workshops and design validation
• Contribute to architecture documentation and solution design reviews

8. Operations Readiness & Knowledge Transfer

• Develop and document: Runbooks SOPs Operational procedures
• Conduct knowledge transfer sessions for operations teams
• Ensure readiness for ongoing PAM operations and support

9. Troubleshooting & Support

• Provide L2/L3 support for CyberArk PAM, Venafi and MFA platform issues
• Certificate lifecycle failures
• Discovery issues
• Renewal failures
• CA integration issues
• Patch Management
• Automation workflow failures
• Perform root cause analysis for: Access issues Password rotation failures xSession management failures
• Work with vendors and internal teams to resolve incidents

Technical Skill Requirements:

Mandatory

• CyberArk Certified Delivery Engineer (CDE-PAM / Privilege Cloud)
• Strong hands-on deployment experience with:
• EPV, CPM, PSM, PVWA, PTA, Privilege Cloud Connector, CyberArk Vendor Privileged Access Manager (Vendor PAM), Cyberark MFA, RSA Authentication Manager, SecurEnvoy
• Solid understanding of:
• Windows Server & Linux (RHEL)
• Active Directory / LDAP
• Networking (firewalls, ports, VPN)
• Scripting
• Knowledge in IAM, Security Best Practices and Zero Trust Methodologies

Preferred

• Experience inlarge-scale enterprise deployments(500+ systems onboarding)
• Venafi TLS Protect Certification
• Venafi Machine Identity Management Certification
• Familiarity with:
• DevOps secrets (e.g., Conjur)
• Cloud PAM (CyberArk Privilege Cloud)
• Strong Expertise in PSM and CPM connector developments
• Experience with PKI and certificate lifecycle management
• TLS Protect
• Certificate Lifecycle Management
• Discovery & Monitoring
• Machine Identity Management
• Certificate Authority Integrations
• Venafi
• TLS Protect
• Certificate Lifecycle Management
• Discovery & Monitoring
• Machine Identity Management
• Certificate Authority Integrations

• Integration experience with:
• Splunk / QRadar other SIEMs
• ServiceNow
• MFA solutions

Soft Skills & Competencies

• Strong stakeholder engagement & communication skills
• Ability to lead technical workshops and discussions
• Structured and documentation-driven mindset
• Experience working in project-based delivery environments

Typical Deliverables

• CyberArk deployment build (Vault, CPM, PSM, PVWA, PTA, CyberArk Cloud, Vendor PAM, MFA)
• Migration and upgrade runbooks
• System onboarding documentation
• SOPs and operational guides
• Integration configuration documents
• Venafi TLS Protect implementation.
• Certificate discovery and automation setup