Domain Architect - OKTA, CyberArk PAM

HCL Technologies Limited; United States; On-site; USD 150,000 - 190,000; Full time

Job summary

Sapsf is seeking an experienced CyberArk Endpoint Privilege Manager (EPM) Architect to design, deploy, and migrate enterprise EPM environments across Windows and macOS. You will lead large-scale implementations, migrate policies between tenants, and implement application control, privilege elevation, and least privilege strategies.

Strong PowerShell scripting and REST API automation, plus experience with Intune, MECM/SCCM, AD, Entra ID, and SIEM, are required to succeed in this role.

Qualifications

• 4+ years hands-on CyberArk EPM architecture and implementation.
• Experience deploying CyberArk EPM in large enterprises.
• Migration of EPM policies and configurations between tenants/environments.
• Strong scripting and API automation skills.

Responsibilities

• Architect, deploy, and configure CyberArk EPM across enterprise Windows and macOS.
• Lead end-to-end migration of EPM policies and configurations between tenants.
• Design and implement application control, privilege elevation, and least privilege strategies.
• Develop, optimize, and troubleshoot EPM policies and rules.
• Integrate EPM with Intune, MECM/SCCM, AD, Entra ID, SIEM, and other platforms.
• Automate deployment, policy management, and migrations using PowerShell and REST APIs.
• Perform architecture reviews and health assessments to improve performance and security.
• Create technical documentation and provide Level 3/4 support and mentoring.

Skills

CyberArk EPM architecture

PowerShell scripting

API automation

Endpoint security

Tenant migration

Windows/macOS administration

Tools

REST APIs

Microsoft Intune

MECM/SCCM

Active Directory

Entra ID

Job description

Requisition ID172866-Posted09/28/2026

experienced CyberArk Endpoint Privilege Manager (EPM) Architect with deep technical expertise in designing, deploying, and migrating enterprise EPM environments. The ideal candidate will lead large-scale implementations, architect scalable privilege management solutions, and drive seamless migrations between CyberArk EPM tenants while minimizing business impact.

Key Responsibilities

• Architect, deploy, and configure CyberArk EPM across enterprise Windows and macOS environments.
• Lead end-to-end migration of CyberArk EPM policies, configurations, application groups, and rule sets from one environment/tenant to another.
• Design and implement application control, privilege elevation, and least privilege strategies.
• Develop, optimize, and troubleshoot EPM policies, trusted applications, and elevation rules.
• Integrate CyberArk EPM with enterprise identity, security, and endpoint management platforms (Microsoft Intune, MECM/SCCM, SentinelOne, SIEM, etc.).
• Automate deployment, policy management, and migration activities using PowerShell and REST APIs.
• Perform architecture reviews, health assessments, and recommend best practices for performance, scalability, and security.
• Collaborate with security, infrastructure, desktop engineering, and application teams throughout implementation and migration projects.
• Create technical documentation, migration runbooks, and operational procedures.
• Provide Level 3/4 technical support and mentor engineering teams.

Skill Requirements

• + years of endpoint security experience with 4+ years of hands-on CyberArk EPM architecture and implementation.
• Proven experience deploying CyberArk EPM in large enterprise environments.
• Strong experience migrating CyberArk EPM from one tenant/environment to another, including policy and configuration migration.
• Deep understanding of application control, privilege management, allow/block rules, elevation policies, and sub-process elevation.
• Strong PowerShell scripting and API automation experience.
• Experience with Microsoft Intune, MECM/SCCM, Active Directory, Entra ID, Windows security, and endpoint management.
• Strong troubleshooting, communication, documentation, and stakeholder management skills.

Other Requirements

• CyberArk certifications (EPM, Defender, Sentry, or Guardian).
• Experience with enterprise transformation, Zero Trust, and Privileged Access Management (PAM) initiatives.
• Experience integrating EPM with SIEM, EDR/XDR, and ITSM platforms.