Cybersecurity Engineer

Expand Energy; Oklahoma City (OK); On-site; USD 110,000 - 160,000; Full time

Benefits offered by this job

Health insurance

Job summary

Expand Energy Corporation in the United States seeks a cybersecurity engineer focused on identity and access management across Active Directory, Okta, SailPoint, CyberArk, and related platforms. This senior technical contributor designs, implements, and maintains secure access services and governance aligned with business requirements.

The role leads complex engineering efforts, mentors colleagues, participates in on-call support, and partners with infrastructure, cloud, and audit teams to

Qualifications

• Advanced IAM principles including SSO, MFA, federation, and Zero Trust.
• Experience administering complex AD environments with GPOs and delegation.
• Experience with Quest Active Roles Server and identity automation.
• Administration of Okta, SailPoint, and CyberArk platforms.
• PowerShell or similar scripting for identity and access automation.

Responsibilities

• Design, implement, administer, and support enterprise identity and access management services.
• Serve as a senior technical owner for directory services and access governance.
• Implement security patterns defined by cybersecurity architects.
• Maintain Active Directory security, OU structures, and GPO policies.
• Administer Quest Active Roles Server capabilities and workflows.
• Configure Okta SSO, MFA, federation, and integrations.
• Support SailPoint identity governance, entitlements, and provisioning.
• Administer CyberArk privileged access management and vaulting.
• Manage TLS certificate lifecycle and remediation of risks.
• Troubleshoot incidents; perform root-cause analyses and corrective actions.
• Identify automation opportunities using PowerShell and APIs.
• Partner with infra, cloud, audit, and business teams on secure access patterns.
• Develop and maintain technical docs, runbooks, and recovery procedures.
• Lead significant engineering work on identity modernization and access management.
• Mentor cybersecurity analysts and engineers; participate in on-call shifts.
• Perform other duties as assigned

Skills

Identity & access mgmt

Active Directory

Okta admin

SailPoint

CyberArk

TLS certificates

PowerShell

Automation scripting

Documentation

Mentoring

Education

High school diploma or GED

Bachelor’s degree in IT, MIS, CS or related field

Tools

Quest Active Roles Server

GPO

Microsoft Active Directory

Okta

SailPoint IdentityNow

CyberArk

Job description

Select how often (in days) to receive an alert:

Our core values — Stewardship, Character, Collaborate, Learn, Disrupt — are the lens through which we evaluate every business decision. As a dynamic, growing company that offers extremely competitive compensation and benefits, our employees are our most valued assets and the foundation of Expand's performance among our E&P competitors.

We seek applicants from all backgrounds to ensure we get the best, most creative talent on our team. We realize that, historically, underrepresented groups feel the need to be 100% qualified in order to apply.If you meet any combination of our requirements, we encourage you to apply. We strive to hire people from a wide variety of backgrounds, not just because it’s the right thing to do, but because it makes our company stronger.

Job Summary

This cybersecurity engineering position is responsible for designing, implementing, administering, and supporting enterprise identity, directory services, privileged access, and access governance solutions. The role serves as a senior technical contributor below the architect level, translating security architecture and standards into reliable operational capabilities across Active Directory, Okta, SailPoint, CyberArk, Quest Active Roles Server, TLS certificate management, and Group Policy. This position leads complex engineering efforts, supports critical cybersecurity services, mentors less experienced team members, and ensures identity and access platforms remain secure, resilient, auditable, and aligned with business and regulatory requirements.

Job Duties & Responsibilities

• Design, implement, administer, and support enterprise identity and access management services, including Active Directory, Okta, SailPoint, CyberArk, Quest Active Roles Server, and related integrations
• Serve as a senior technical owner for directory services, authentication, authorization, privileged access, identity governance, and access lifecycle processes
• Implement solution architectures, technical standards, and security patterns defined by cybersecurity architects and leadership
• Maintain and improve Active Directory security, including domain administration, OU structure, delegation models, privileged groups, administrative accounts, and GPO policies
• Administer Quest Active Roles Server capabilities, including delegated administration, workflow support, provisioning controls, and operational automation
• Configure, support, and troubleshoot Okta SSO, MFA, federation, application integrations, authentication policies, and related identity controls
• Support SailPoint identity governance processes, including access requests, access certifications, entitlement ownership, provisioning workflows, and integration health
• Administer CyberArk privileged access management capabilities, including vaulted credential onboarding, safe permissions, credential rotation, privileged session controls, and operational support
• Manage and improve enterprise TLS certificate lifecycle processes, including certificate inventory, issuance, renewal coordination, expiration tracking, and remediation of certificate-related risks
• Troubleshoot and resolve complex identity, directory, authentication, authorization, certificate, and privileged access incidents; participate in root-cause analysis and corrective action planning
• Identify and implement automation opportunities using tools such as PowerShell, scripting, APIs, and workflow automation to improve repeatability, control effectiveness, and operational efficiency
• Partner with infrastructure, application, cloud, audit, and business teams to implement secure access patterns and resolve identity-related issues
• Develop and maintain technical documentation, standards, runbooks, recovery procedures, diagrams, and operational evidence supporting audit and compliance requirements
• Lead significant technical work efforts or smaller projects related to identity modernization, privileged access, access governance, directory hardening, and certificate management
• Provide technical guidance and mentoring to cybersecurity analysts, administrators, and engineers while escalating architectural decisions when appropriate
• Participate in cybersecurity operational support and on-call responsibilities as required for critical identity and access services
• Perform other duties as assigned

Job Specific Skills

• Advanced knowledge of enterprise identity and access management principles, including SSO, MFA, federation, identity governance, privileged access management, RBAC, least privilege, and Zero Trust concepts
• Strong hands-on experience administering Microsoft Active Directory in a complex enterprise environment, including domain services, GPOs, administrative delegation, privileged access, and directory hardening
• Experience with Quest Active Roles Server or similar delegated administration and identity automation tools
• Experience administering Okta, including application integrations, authentication policies, MFA, SSO, federation, delegated authentication, and troubleshooting
• Experience supporting SailPoint IdentityNow or similar identity governance platforms, including access requests, certifications, entitlement ownership, provisioning, and workflow support
• Experience administering CyberArk or similar privileged access management platforms, including credential vaulting, safe permissions, credential rotation, session management, and privileged account controls
• Strong understanding of TLS certificate management, certificate authorities, certificate lifecycle processes, and operational risks associated with expired or misconfigured certificates
• Proficiency with PowerShell and scripting or automation tools used to manage identity, directory, certificate, and access-related processes at scale
• Strong troubleshooting and problem-solving skills across hybrid identity, SaaS applications, Windows infrastructure, cloud services, and enterprise security platforms
• Good understanding of audit, compliance, SOX control expectations, access review evidence, and documentation practices related to identity and privileged access management
• Ability to translate cybersecurity architecture, standards, and control objectives into practical engineering tasks and operational processes
• Effective written and verbal communication skills; able to work with technical teams, application owners, vendors, auditors, and business stakeholders
• Demonstrated ability to lead complex technical work, manage competing priorities, mentor others, and drive assigned initiatives to completion with limited supervision

Education

Minimum: High school diploma or GED

Preferred: Bachelor’s degree - from accredited university - IT, MIS, Computer Science or related field

Experience

Minimum: 5 years related work experience

Additional Qualifications

Preferred Certifications

• CISSP, CISM, or similar cybersecurity certification
• Microsoft identity, security, or Azure certifications such as SC-300, AZ-500, or equivalent
• Okta, SailPoint, CyberArk, Microsoft, or directory services certifications relevant to identity, access governance, or privileged access management
• CompTIA Security+ or other foundational cybersecurity certification

What Success Looks Like

• Becomes a trusted senior engineer for Active Directory, Quest Active Roles Server, Okta, SailPoint, CyberArk, TLS certificate management, and GPO-related support
• Stabilizes and improves identity and access operations while reducing dependence on any single individual for critical platform knowledge
• Improves documentation, recovery readiness, audit evidence, and operational procedures for key identity and privileged access services
• Identifies automation opportunities that reduce manual effort and improve the reliability of access, certificate, and directory management processes
• Contributes to senior engineering and architecture discussions while remaining focused on hands-on execution, platform ownership, and operational excellence

Expand Energy takes necessary action to ensure that all applicants are treated without regard to their race, color, religion, sex, sexual orientation, age, gender identity, national origin, genetic information, disability, pregnancy, military or veteran status or any other protected characteristic as established by law.

Expand Energy Corporation's operations are focused on discovering and developing its large and geographically diverse resource base of unconventional oil and natural gas assets onshore inthe United States.

Nearest Major Market: Oklahoma City
Nearest Secondary Market: Oklahoma
Job Segment: Developer, Computer Science, Compliance, Engineer, Technology, Legal, Engineering