PAM Engineer

Eliassen Group; Cary (NC); Hybrid; USD 117,000 - 143,000; Full time

Benefits offered by this job

Equity awards

Comprehensive benefits package

Bonus eligibility (10%)

Job summary

Eliassen Group in Cary, NC is seeking a Privileged Access Management Engineer to strengthen privileged access security across cloud, on‑premises, and hybrid environments. You will engineer and support PAM solutions, reduce privileged access risk, and help advance Just-In-Time access, least privilege, and Zero Standing Privilege across the enterprise.

This full‑time opportunity offers a salary up to $130K plus 10% bonus and yearly equity awards, with a comprehensive benefits package.

Qualifications

• 3+ years in PAM/IAM within large enterprise environments.
• 2+ years administering CyberArk, BeyondTrust, Delinea (CyberArk not required).

Responsibilities

• Design, implement, and support enterprise PAM across cloud, on‑prem, and hybrid.
• Engineer privileged access capabilities including vaulting, rotation, session management, and lifecycle.
• Support ZSP, JIT, least privilege, RBAC, and access reduction initiatives.
• Secure privileged and non‑human identities and on‑board systems to PAM platforms.
• Collaborate with infrastructure, cloud, app, and platform teams for onboarding.
• Support Microsoft Entra ID capabilities including PIM, MFA, and Conditional Access.
• Develop runbooks and procedures; automate access processes via PowerShell, Python, REST APIs.
• Troubleshoot PAM issues, perform root-cause analyses, and remediate.

Skills

PAM/IAM

Credential vaulting

Password rotation

Just-In-Time access

Zero Standing Privilege

RBAC

PowerShell

Python

REST APIs

Active Directory

Education

Bachelor's degree in Cybersecurity/IT/CS/Engineering

Tools

CyberArk

BeyondTrust

Delinea

Job description

Description:

Hybrid in Cary, NC

Our client seeks a Privileged Access Management (PAM) Engineer to strengthen privileged access security across cloud, on-premises, and hybrid environments. You will engineer and support PAM solutions, reduce privileged access risk, and help advance Just-In-Time access, least privilege, and Zero Standing Privilege across the enterprise.

This is a full-time, permanent opportunity, offering a salary up to $130K plus 10% bonus and yearly equity awards and comprehensive benefits package. Qualified applicants must be willing and able to work on a W2 basis.

Responsibilities:

• Design, implement, and support enterprise PAM solutions across cloud, on-premises, and hybrid environments.
• Engineer privileged access capabilities including credential vaulting, password rotation, session management, privileged account onboarding, break-glass access, and account lifecycle management.
• Support Zero Standing Privilege (ZSP), Just-In-Time (JIT) access, least privilege, RBAC, and privileged access reduction initiatives.
• Secure privileged users, administrative accounts, service accounts, application identities, machine identities, and other non-human identities.
• Partner with infrastructure, cloud, application, and platform teams to onboard systems, applications, servers, databases, endpoints, and cloud resources into PAM platforms.
• Support Microsoft Entra ID capabilities including PIM, MFA, Conditional Access, and other access security controls.
• Develop and maintain privileged access standards, engineering runbooks, and operational procedures.
• Automate identity and privileged access processes using PowerShell, Python, REST APIs, workflow automation, and platform integrations.
• Troubleshoot PAM platform issues, perform root cause analysis, and implement corrective actions.
• Work with Security Operations and other teams to investigate privileged access risks, control gaps, and identity-related security incidents.
• Other duties as assigned.

Experience Requirements:

• 3+ years of experience with PAM, IAM, or identity security solutions in large enterprise environments.
• 2+ years of hands-on experience administering CyberArk, BeyondTrust, Delinea, or an equivalent enterprise PAM platform. CyberArk is not required.
• Strong experience with credential vaulting, password rotation, privileged account onboarding, session management, and account lifecycle management.
• Experience with Zero Standing Privilege (ZSP), Just-In-Time (JIT) access, least privilege, RBAC, and break-glass access.
• Working knowledge of Microsoft Entra ID, PIM, MFA, Conditional Access, and Active Directory.
• Understanding of SSO, federation, authentication, and authorization technologies such as SAML, OAuth 2.0, OIDC, and LDAP.
• Experience with PowerShell, Python, REST APIs, or workflow automation is preferred.
• Ability to assess privileged access risks, identify control gaps, and recommend remediation.
• Approximately 5% travel may be required.

Education Requirements:

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field, or equivalent experience.