CyberArk Engineer -OT / Critical Infrastructure (Contract)

KeyData Cyber; United States; Remote; USD 110,000 - 165,000; Full time

Job summary

KeyData Cyber is seeking a CyberArk Engineer to design, implement, and run PAM solutions for OT and regulated utility clients in North America. You will secure privileged accounts, manage Digital Vault, PVWA, CPM, and DR Vaults, and ensure resilience across on-prem, segmented, and air-gapped networks.

You will collaborate with OT, IT, and compliance teams, perform health checks, and create runbooks and documentation to support audit and security goals.

Qualifications

• 5+ years hands-on CyberArk engineering and PAM experience.
• Experience deploying Digital Vault, CPM, PVWA, and DR Vaults including failover tests.
• Experience in OT, regulated utilities, or air-gapped environments.
• Familiarity with NERC CIP controls and resilience requirements.
• Hands-on onboarding of privileged accounts (Windows Server, Linux, SSH keys, service accounts, DBs).

Responsibilities

• Deploy, configure, and support CyberArk PAM components (Digital Vault, PVWA, CPM, PSM, DR Vaults).
• Configure Safes, onboarding, credential rotation and reconciliation accounts across OT and enterprise.
• Plan and execute failover, backup/restore, and DR testing for critical systems.
• Onboard and manage privileged accounts across Windows Server, RHEL/Linux, SSH keys, service accounts, scheduled tasks, apps, databases.
• Implement secure privileged access controls aligned with NERC CIP and change management.
• Work in air-gapped/segmented networks and adapt deployment/patching on restricted connectivity.
• Collaborate with OT, infrastructure, security, and compliance to translate requirements into PAM designs.
• Perform upgrades, troubleshooting, health checks, and maintain platform availability & security.
• Create technical docs, SOPs, runbooks, compliance evidence, and conduct knowledge transfers.

Skills

CyberArk PAM

Privileged access management

OT security

NERC CIP

Communication - OT/IT/Compliance

Tools

Digital Vault

PVWA

CPM

PSM

Disaster Recovery Vaults

Job description

At KeyData Cyber, we’re shaping the future of identity security. Recognized by Gartner and KuppingerCole as a leading IAM professional services firm, we specialize exclusively in designing, deploying, and managing end-to-end Identity and Access Management programs for organizations across North America.

With 20years of experience, 50M+ identities managed, and 1,000+ successful deployments, our team is our strongest asset and is built by design to help clients protect critical infrastructure, enable digital transformation, and ensure compliance with confidence.

We deliver comprehensive solutions across IAM domains, including:

• Workforce IAM (Access Management, Identity Governance and Administration, Privileged Access Management)
• Consumer IAM (Identity Verification, Authentication and Access, Threat Detection) in highly regulated industries.

If you’re ready to grow your career alongside some of the industry’s best, come join us — you’re key to our success

As a CyberArk Engineer , you will be part of our Delivery Services Team, supporting the design, implementation, administration, and optimization of Privileged Access Management (PAM) solutions for clients in operational technology (OT) and regulated utility environments. You will play a critical role in securing privileged accounts, credentials, and access to critical systems while ensuring the resilience, integrity, and availability of the CyberArk platform across on-premises, segmented, and air-gapped infrastructure.

Location: USA, Remote

Employment Type: Contract, Immediate Start through March 2027

What You’ll Do:

• Deploy, configure, and support CyberArk PAM components, including Digital Vault, PVWA, CPM, PSM, and Disaster Recovery Vaults.
• Configure Safes, platform onboarding, credential rotation, and reconciliation accounts across OT and enterprise environments.
• Plan and execute failover, backup/restore, and disaster recovery testing to meet resilience requirements for critical systems.
• Onboard and manage privileged accounts across Windows Server, RHEL/Linux, service accounts, SSH keys, scheduled tasks, application pools, and database platforms.
• Implement secure privileged access controls that align with NERC CIP requirements and client change management processes.
• Work in air-gapped and segmented networks, adapting deployment, patching, and support approaches to restricted connectivity.
• Collaborate with OT, infrastructure, security, and compliance teams to gather requirements and translate them into PAM designs.
• Perform upgrades, troubleshooting, and health checks, and maintain platform availability and security compliance.
• Create technical documentation, SOPs, operational runbooks, and compliance evidence, and conduct knowledge transfer sessions.

Who We’re Looking For:

• 5+ years of hands-on experience with CyberArk engineering and Privileged Access Management solutions.
• Strong experience deploying and configuring Digital Vault, CPM, PVWA, and Disaster Recovery Vaults, including failover and restore testing.
• Experience working in OT, regulated utility, or air-gapped environments.
• Familiarity with NERC CIP controls, change management, and resilience requirements for critical infrastructure.
• Hands-on experience onboarding privileged accounts across Windows Server, RHEL/Linux, SSH keys, service accounts, scheduled tasks, application pools, and databases.
• Solid knowledge of Active Directory, LDAP, network segmentation, and enterprise infrastructure.
• Strong troubleshooting, analytical, and problem-solving abilities.
• Ability to work in a team environment as well as independently.
• Strong verbal and written communication skills, with the ability to explain technical concepts to OT, IT, and compliance stakeholders.

Nice-to-Have Skills:

• CyberArk certifications such as CDE – PAM, Sentry PAM, or Defender PAM.
• OT security certifications such as GICSP, or experience with ISA/IEC 62443.
• Experience with PSM/PSMP for secure remote access into OT environments.
• Experience integrating CyberArk with MFA, SIEM, and ITSM tools.
• Scripting and automation experience using PowerShell, Python, or REST APIs.
• Previous consulting or client-facing implementation experience. #LI-RR1

Why You’ll Love Working Here

At KeyData Cyber, we put people first, valuing learning, growth, and work-life balance. We offer extensive opportunities to advance your career through leading digital identity projects across North America. Our culture is built on respect, inclusion, and equal opportunity for everyone.

Accessibility & Accommodations

If you require accommodation due to a disability at any time during the recruitment and/or assessment process, please contact Talent Acquisition, and we will make all reasonable efforts to accommodate your request.

Fraud Prevention & Identity Verification

We may use information provided during the application process to help prevent fraud and verify identity. These checks may be conducted automatically through trusted third‑party service providers as part of our standard application screening process.