Principal Architect SME - CyberArk

Paychex Inc.; Ashburn, Northern (VA, KY); Hybrid; USD 150,000 - 210,000; Full time

Job summary

Jazz Solutions Inc. seeks a CyberArk Principal Architect / PAM SME to lead architecture, deployment, and operations of a multi-tenant CyberArk PAM environment for a large federal customer.

The role spans on-premises and cloud, with AWS GovCloud hosting and FedRAMP High compliance, requiring collaboration with cybersecurity, ICAM, cloud, and operations teams. The Principal Architect will drive HA/DR, access controls, audit logging, and integrations with SailPoint, Splunk, ITSM, and monitoring

Qualifications

• Bachelor’s degree in CS/Cybersecurity/Engineering.
• 10+ years of cybersecurity/IAM with 7+ years CyberArk PAM engineering/architecture experience.
• Experience architecting CyberArk in large, highly regulated federal or comparable enterprise environments and AWS/cloud-hosted environments.
• Experience with PIV/MFA/SSO, privileged access controls, audit logging, FISMA/RMF, vulnerability remediation, and 24x7 production operations.
• CyberArk certification(s) required or strongly preferred.
• Prior experience as CyberArk Architect/Principal Architect/Lead PAM Engineer for federal agency.

Responsibilities

• Serve as principal technical authority for CyberArk PAM architecture, engineering, and operations.
• Design and maintain CyberArk vaults, CPM, PSM, PVWA, and privileged-account lifecycle.
• Ensure multi-tenant segregation across Windows, Linux, mainframes, databases, and cloud.
• Oversee authentication, SSO integration, session recording, and audit controls.
• Lead HA/DR architecture and incident response for high availability.
• Integrate CyberArk with SailPoint/Splunk/ITSM and monitoring services.
• Provide leadership and mentoring to CyberArk engineers; perform RCA and knowledge transfer.

Skills

CyberArk PAM engineering

PAM architecture

AWS GovCloud

PIV/MFA/SSO

24x7 ops

Mentoring

Incident analysis

Stakeholder comms

RCA expertise

FedRAMP High

Education

Bachelor’s in CS/Cybersecurity/Engineering

Tools

CyberArk PAS/PAM

Vault/CPM/PSM/PVWA

Conjur

SailPoint

Splunk

ITIL

AWS GovCloud

Job description

About the Organization JSL delivers customer-centric IT solutions for Federal, State and local governments. We offer our customers three distinct advantages: expertise in our service offerings, leadership that drives innovation, and a culture focused on customer satisfaction. Our mission is to cultivate relationships, responsibility and results through people, purpose and process.

Hybrid Role - Ability to travel 20-40%, on average, to the DC area based on frequency of client meetings and level of project engagement required.

Position Summary:

The CyberArk Principal Architect / Privileged Access Management (PAM) SME will serve as the senior technical authority for the architecture, implementation, integration, security, and operation of an enterprise CyberArk PAM environment supporting a large federal customer. The individual will provide architectural leadership for a highly available, multi-tenant CyberArk environment hosted within AWS GovCloud / FedRAMP High, supporting privileged access across on-premises and cloud infrastructure.

The Principal Architect will work with cybersecurity, ICAM, cloud, infrastructure, application, and operations teams to ensure the PAM solution meets federal security requirements, availability objectives, disaster recovery requirements, and operational SLAs.

Specific Duties to Perform / General Position Description:

• Serve as the principal technical authority for CyberArk TCPAM/PRIVMGMT and CyberArk PAS architecture, engineering, operations, and solution enhancements.
• Architect and oversee CyberArk vault, CPM, PSM, PVWA, privileged account lifecycle, safes, reconciliation, recertification, break-glass, backup/restore, DR, certificate renewal, and platform scaling.
• Design and maintain multi-tenant bureau segregation and privileged access across Windows, *nix, mainframes, network devices, databases, and cloud environments.
• Ensure PIV IAL3/AAL3 primary authentication, SSO integration, privileged-session recording/playback, audit logging, and password/passphrase controls.
• Lead HA/DR architecture across AWS Availability Zones and support RTO/RPO objectives and CyberArk maximum tolerable downtime requirements.
• Integrate CyberArk with SailPoint/TCCM/Identity Security Cloud for PRIV/MUR data and with Splunk, CloudTrail, ITSM, and monitoring/security services.
• Provide technical leadership for CyberArk Secure Web Sessions, EPM policy, Conjur secrets management, and Ansible automation where activated.
• Lead Tier 3 troubleshooting, architecture reviews, RCA, security patching, vulnerability remediation, technical documentation, runbooks, and knowledge transfer.
• Design and maintain secure privileged account management across Windows, Linux/Unix, databases, network devices, mainframes, applications, cloud platforms, service accounts, and non-person entities (NPEs).
• Establish PAM architecture standards, patterns, technical baselines, engineering procedures, and security configuration standards.
• Troubleshoot complex CyberArk issues and lead technical root-cause analysis (RCA) for high-priority incidents.
• Develop and validate CyberArk monitoring, alerting, logging, and audit capabilities and integration with enterprise monitoring/SIEM platforms.
• Support cybersecurity and authorization activities including NIST 800-53/RMF, FISMA, FedRAMP High, POA&M remediation, vulnerability remediation, audit requests, and penetration testing.
• Provide technical leadership and mentoring to CyberArk engineers and administrators and support structured knowledge transfer to Federal personnel.
• Evaluate proposed CyberArk changes and enhancements for security, architectural fit, performance, availability, and operational impact.

Position Qualifications/Experience/Education:

Required Qualifications:

• Bachelor’s degree in Computer Science, Cybersecurity, Engineering, Information Systems, or related field; 10+ years of cybersecurity/IAM experience with 7+ years of deep CyberArk PAM engineering/architecture experience.
• Expert knowledge of CyberArk PAS/PAM components including Vault, CPM, PSM, PVWA, safes, account onboarding/reconciliation, session management, HA/DR, and enterprise integrations.
• Experience architecting CyberArk in large, highly regulated federal or comparable enterprise environments and AWS/cloud-hosted environments.
• Experience with PIV/MFA/SSO, privileged access controls, audit logging, FISMA/RMF, vulnerability remediation, and 24x7 production operations.
• Ability to lead complex troubleshooting, solution design, technical reviews, and mentoring/knowledge transfer.
• CyberArk technical certification(s) appropriate to senior architecture/engineering responsibilities required or strongly preferred.
• Prior experience serving as a CyberArk Architect, Principal Architect, or Lead PAM Engineer for a federal agency.
• Treasury Expeience

Desired Qualifications:

• Recent federal delivery experience supporting CyberArk PAM in a managed-service environment.
• Experience with large CyberArk deployments.
• Experience with Conjur, EPM, SWS, Ansible, Splunk, AWS GovCloud, and FIPS 140-2/140-3 HSM solutions.
• CISSP, CCSP, or AWS certification.

Competencies:

• Strong communicator able to work effectively with federal agency stakeholders, bureau teams, technical teams, and vendors.
• Highly organized and outcome-focused; able to manage competing priorities in a 24x7 managed-service environment.
• Proactive problem-solver who can operate with limited direction and drive issues through resolution.
• Comfortable in Agile/Scrum/Kanban and ITIL-aligned environments with disciplined change, incident, and problem management.
• Adaptable to changing BPA Call priorities, security requirements, and SLA-driven delivery.
• Strong written and verbal communication skills with the ability to communicate architecture and security concepts to Government technical and management stakeholders.
• Ability to provide technical leadership and mentoring to CyberArk engineers and administrators

EOE Statement In compliance with the Americans with Disabilities Act (ADA), if you have a disability and would like to request an accommodation in order to apply for a position with Jazz Solutions Inc., please call 410-905-5084 or e-mail [e-mail].

Jazz Solutions Inc. is proud to be an Equal Opportunity Employer. We seek individuals from a broad variety of backgrounds with varying levels of experience who have a desire to do meaningful work. We recruit, employ, train, compensate, and promote regardless of race, color, gender, gender identity, religion, national origin, ancestry, disability, age, veteran status, sexual orientation, or any other characteristic protected by law.

This position is currently accepting applications.