Lead PAM Engineer: Identity & Access Security

Morgan Stanley; Boston (MA); On-site; USD 135,000 - 195,000; Full time

Job summary

Morgan Stanley is seeking a Lead Privilege Access Management Engineer to design, implement, and operate enterprise PAM solutions across on-prem and cloud environments. You will lead hands-on engineering for human and non-human identities, integrating with authentication mechanisms and federation services, and driving reliability with IaC, Kubernetes, and CI/CD.

The role requires 12+ years in cyber security engineering, deep authentication expertise, and mastery of PAM platforms (CyberArk, Vault,

Qualifications

• 12+ years of cyber security engineering with hands-on principal engineering (not just architecture).
• Deep authentication expertise: OIDC/OAuth2, SAML, SSO, FIDO2/WebAuthn, PKI (CA/RA, mTLS, cert lifecycle).
• Experience deploying PAM, Pcloud, Endpoint Privilege Management to cloud/hybrid environments including Azure or GCP.
• Mastery of Privilege Access platforms and integration (IDIRA/CyberArk) including PVWA, CPM, PSM, SIA, PTA.
• IAM platforms & integration with Entra ID, HashiCorp Vault, Ping Identity, IDM/LDAP; policy-as-code and open standards.
• Resiliency and automation at scale with IaC (Terraform), CI/CD, observability; strong scripting skills.
• Security & compliance acumen: least privilege, secrets management, auditability for human and non-human identities.

Responsibilities

• Lead Hands-On PAM Engineering: design, build, integrate, and ship secure, scalable Privilege Access Management solutions for human and non-human identities (bots, service accounts, applications).
• Own Enterprise PAM products, Integration with Authentication & Federation: implement and harden Privilege Access solutions, OIDC/OAuth2, SAML, SSO, FIDO2/WebAuthn, PKI, API auth, and Unix/Linux authentication.
• Integrate and Customize PAM Platforms across on-prem and cloud environments: CyberArk, EPM, PTA, Entra ID, Ping Identity, Vault, HSMs, IDM/LDAP.
• Drive Reliability and Automation at Scale: operate large-scale PAM estates with HA/DR, IaC, Kubernetes app development, config management, CI/CD, observability.
• Harden and Govern Identity Controls: define policies for Endpoints Privilege management, identity lifecycle, authentication, authorization, and secrets management.
• Assess and uplift existing solutions: identify risks, deliver remediation plans, ensure secure-by-default patterns.
• Translate Architecture into Executable Work: break designs into epics, stories, runbooks; produce architecture reviews and audit-ready docs.
• Partner and operate across teams: collaborate with product/platform leads, participate in on-call, lead RCAs, drive operational excellence.

Skills

Hands-on PAM engineering

Cyber security engineering

Authentication expertise

OIDC/OAuth2

SAML/SAML2

WebAuthn/FIDO2

PKI and mTLS

PAM platforms integration

IaC/Automation

Shell/PowerShell/Python

Tools

CyberArk (IDIRA)

Endpoint Privilege Manager (EPM)

Pcloud

Vault (HashiCorp)

Entra ID

Ping Identity

HashiCorp Vault

Kubernetes

Terraform

Ansible

Puppet

Chef

Job description

Morgan Stanley is seeking a Lead Privilege Access Management Engineer to design, implement, and operate enterprise PAM solutions across on-prem and cloud environments. You will lead hands-on engineering for human and non-human identities, integrating with authentication mechanisms and federation services, and driving reliability with IaC, Kubernetes, and CI/CD.

The role requires 12+ years in cyber security engineering, deep authentication expertise, and mastery of PAM platforms (CyberArk, Vault,