CyberArk Engineer - OT / Critical Infrastructure

Go Fractional; Northern (KY); Remote; USD 165,000 - 248,000; Full time

Job summary

Go Fractional is seeking an experienced CyberArk Engineer for OT and critical infrastructure work. This contract role is remote in the USA with immediate start through March 2027.

You will deploy and configure Digital Vault, PVWA, CPM, and DR Vaults; onboard privileged accounts; ensure NERC CIP compliance; and collaborate with OT, IT, and security teams to strengthen privileged access across Windows and Linux systems.

Qualifications

• 5+ years of hands-on CyberArk engineering experience.
• Experience deploying Digital Vault, PVWA, CPM, and DR Vaults with failover testing.
• Experience in OT, regulated environments or air-gapped networks.
• Knowledge of NERC CIP controls and change management.
• Onboarding privileged accounts across Windows/Linux/SSH keys.

Responsibilities

• Deploy, configure, and support CyberArk PAM components across environments.
• Configure safes, onboarding, rotation, and reconciliation accounts.
• Plan and execute failover, backup/restore, DR testing for critical systems.
• Onboard and manage privileged accounts across Windows, RHEL/Linux, SSH keys, service accounts.
• Implement secure privileged access controls aligned with NERC CIP and change management.
• Work in air-gapped networks, adapting deployment and patching.
• Collaborate with OT, infrastructure, security, and compliance teams for PAM designs.
• Perform upgrades, troubleshooting, health checks, and maintain availability.
• Create technical docs, SOPs, runbooks, and compliance evidence; conduct knowledge transfer.

Skills

CyberArk PAM

PAM deployment

OT/Industrial

AD/LDAP

Troubleshooting

Tools

Digital Vault

PVWA

CPM

Disaster Recovery Vaults

PSM

MFA integration

Job description

CyberArk Engineer - OT / Critical Infrastructure (Contract)

Location: USA, Remote

Employment Type: Contract, Immediate Start through March 2027

What You'll Do:

• Deploy, configure, and support CyberArk PAM components, including Digital Vault, PVWA, CPM, PSM, and Disaster Recovery Vaults.
• Configure Safes, platform onboarding, credential rotation, and reconciliation accounts across OT and enterprise environments.
• Plan and execute failover, backup/restore, and disaster recovery testing to meet resilience requirements for critical systems.
• Onboard and manage privileged accounts across Windows Server, RHEL/Linux, service accounts, SSH keys, scheduled tasks, application pools, and database platforms.
• Implement secure privileged access controls that align with NERC CIP requirements and client change management processes.
• Work in air-gapped and segmented networks, adapting deployment, patching, and support approaches to restricted connectivity.
• Collaborate with OT, infrastructure, security, and compliance teams to gather requirements and translate them into PAM designs.
• Perform upgrades, troubleshooting, and health checks, and maintain platform availability and security compliance.
• Create technical documentation, SOPs, operational runbooks, and compliance evidence, and conduct knowledge transfer sessions.

Who We're Looking For:

• 5+ years of hands-on experience with CyberArk engineering and Privileged Access Management solutions.
• Strong experience deploying and configuring Digital Vault, CPM, PVWA, and Disaster Recovery Vaults, including failover and restore testing.
• Experience working in OT, regulated utility, or air-gapped environments.
• Familiarity with NERC CIP controls, change management, and resilience requirements for critical infrastructure.
• Hands-on experience onboarding privileged accounts across Windows Server, RHEL/Linux, SSH keys, service accounts, scheduled tasks, application pools, and databases.
• Solid knowledge of Active Directory, LDAP, network segmentation, and enterprise infrastructure.
• Strong troubleshooting, analytical, and problem-solving abilities.
• Ability to work in a team environment as well as independently.
• Strong verbal and written communication skills, with the ability to explain technical concepts to OT, IT, and compliance stakeholders.

Nice-to-Have Skills:

• CyberArk certifications such as CDE - PAM, Sentry PAM, or Defender PAM.
• OT security certifications such as GICSP, or experience with ISA/IEC 62443.
• Experience with PSM/PSMP for secure remote access into OT environments.
• Experience integrating CyberArk with MFA, SIEM, and ITSM tools.
• Scripting and automation experience using PowerShell, Python, or REST APIs.
• Previous consulting or client-facing implementation experience.