Privilege Access Management Engineer

Hub International; Chicago (IL); Hybrid; USD 100,000 - 120,000; Full time

Job summary

HUB International in Chicago is seeking a Privileged Access Management Engineer to oversee PAM platforms, automation, and integration across the enterprise. You will implement, maintain, and optimize Delinea/Secret Server, Admin by Request, Keeper, and related identity services, aligning with IAM concepts.

The role requires 3+ years in IAM, 5+ years cloud experience, proficiency with AD Entra ID, SAML/OAuth, and scripting.

Qualifications

• Bachelor's degree in technology or applicable field.
• 3+ years in Identity and Access Management roles.
• Experience with Privileged Access Management platforms.

Responsibilities

• Manage PAM platforms (Secret Server, Admin by Request, Keeper) and ensure high availability.
• Contribute to identity operations reporting and governance.
• Troubleshoot PAM-related issues and optimize credential vaulting and rotation.
• Integrate PAM with SailPoint ISC and ITSM systems for audits and governance.

Skills

IAM concepts

Automation & scripting

Collaboration

Incident response

Education

Bachelor's degree in technology or applicable experience

Tools

Delinea/Secret Server

Admin by Request

Keeper

SailPoint ISC

PowerShell

Python

Active Directory / MS Entra ID

Job description

Privilege Access Management Engineer### Privilege Access Management EngineerSolicitar: Hybrid Working: Chicago, IL: Full time: Publicado hoy: R0038263**A path for every ambition.**At HUB, we believe the best work happens when people are given real space to grow and then given the autonomy to exercise it. We power progress and protect ambition: for the clients who count on us, and equally for the people who make that possible every day.We’re creative thinkers and determined doers, guided by values that show up in how we work together: with empathy, adaptability, accountability and a genuine commitment to one another’s success. We foster bold ideas, celebrate curiosity and share what we know. Because when people grow, the work they do grows with them.Our purpose is deeply human: to help people navigate the world on their terms, at their speed, toward their future. We hold that same commitment to the people building careers here.Whether you’re starting out or leveling up, you’ll find the resources to evolve, the support to take on more and a team ready to back you at every stage.Your ambition has a home here. Job Description**ABOUT US**At HUB International, we are a team of entrepreneurs. We believe in protecting and supporting the aspirations of individuals, families, and businesses. We help our clients evaluate their risks and develop solutions tailored to their needs. We believe in empowering our employees to learn, grow, and make a difference. Our structure enables our teams to maintain their own unique, regional culture while leveraging support and resources from our corporate centers of excellence.HUB is a global insurance and employee benefits broker, providing a boundaryless array of business insurance, employee benefits, risk services, personal insurance, retirement, and private wealth management products and services. With over $5 billion in revenue and almost 20,000 employees in 600 offices throughout North America, HUB has grown substantially, in part due to our industry leading success in mergers and acquisitions**ABOUT THIS ROLE**In this role, you will manage multiple aspects of information security operations, response, and engineering. This position will contribute to a team focusing on the included, but not limited to, incident response, playbook development and execution, operational engineering, tooling maintenance, as well as being a key participant within Information security programs. They will work in close collaboration with all HUB IT teams to design and support effective Information Security Operations for Hub International.## ## Job DescriptionThe Security Identity PAM Engineer is responsible for implementing, maintaining, and developing HUB’s Privileged Access Management platforms. This role focuses on automation, integration, and customization ensuring robust and scalable identity services across the organization. The ideal candidate will have strong knowledge of IAM concepts, with the ability to improve and strengthen HUB’s privileged access foundations.## Objectives of this Role* Manages and is responsible for the successful completion of all tasks in assigned projects.* Contribute to Security Support and Identity Operations Team focused on maintaining the security integrity of HUB’s PAM suite of applications.* Available 24/7 for any critical security incident response that may arise which requires immediate resolution.* Work to ensure security identity tooling within HUB environments is operational and operating at needed levels of service and availability.* Contribute to identity operations KPIs to measure operational performance.* Maintain current knowledge of relevant information security identity, authentication, authorization, and governance technology and techniques, bringing forth ideas for modernization and improvement.* Ensure identity operations practices provide a sound foundation that utilizes tools and processes for rapid identification of security events to address and mitigate risks.* Engage with peers regularly on security operations functions, project status, activities, and achievements.* Contribute to “Continuous Improvement” efforts, in respect to HUB’s information security identity tooling and systems.* Assist in planning, organizing, and executing multiple responsibilities to achieve project goals and provide technical leadership to move operational projects to completion.* Contribute to security requirements, standards, procedures, and reference architectures to comply with policies and technical standards.## Daily and Monthly Responsibilities* Contribute with analysis, governance, and certification operations related to identity management.* Contribute to weekly and monthly posture and identity operations reporting.* Create and maintain technical documentation, including solution architecture, process flows, and configuration guides.* Troubleshoot PAM-related issues and ensure high availability and performance of identity services.* Contribute to the analysis and recommendation of upgrades, changes, implementation specific to the support and scaling of HUB’s security identity operations.* Implement, administer, and maintain HUB’s privileged access management platforms, including Delinea/Thycotic Secret Server, Admin by Request, and Keeper.* Manage credential vaulting, automated secret rotation, and session recording/monitoring within Secret Server.* Manage the lifecycle of, and certification campaigns for, HUB’s privileged credentials and secrets* Design and maintain endpoint privilege elevation workflows and approval chains using Admin by Request.* Administer role-based access and shared credential structures within Keeper.* Integrate PAM platforms with SailPoint ISC to unify privileged account discovery and access certification.## Skills and Qualifications* Bachelor’s degree in technology or applicable experience.* Related certifications (e.g., GSEC, CISSP, GIAC, AWS) preferred.* 3+ Years of experience within Identity and Access Management roles.* 5+ years of experience with cloud infrastructure (AWS, GCP, Azure) and O365 services and technology.* Experience with, but not excluded to: SAML, OID, oAuth, SCIM, MFA.* Experience working with and managing Active Directory / MS Entra ID.* Experience with PowerShell, python, shell scripting, XML, JSON, REST/SOAP.* Working knowledge of Active Directory, MS Entra ID, and Okta.* Knowledge of information security identity standards, principles, and practices required.* Knowledge of industry security standards, guidelines, and regulatory/compliance requirements related to information security such as ISO 27001, NIST 800-53, SOC2, PCI, SOX, etc.* 3+ years of hands-on experience with Delinea/Thycotic Secret Server, including vaulting, secret rotation, policy configuration, discovery, and reporting.* Experience with Admin by Request for endpoint privilege management, including elevation request/approval workflows and application control policies.* Experience with Keeper (Keeper Secrets Manager / Keeper Enterprise) for secrets vaulting, credential sharing, and access provisioning.* Knowledge of just-in-time (JIT) privileged access provisioning and least-privilege enforcement, including removal of standing local admin rights.* Experience with privileged session management, session recording/monitoring, and break-glass/emergency access account procedures.* Experience managing service account and application-to-application (A2A) credential rotation via PAM platform APIs.* Ability to integrate PAM platforms (Secret Server, Admin by Request, Keeper) with SailPoint ISC and ITSM/ticketing systems for unified governance and audit reporting.* Prioritization, decision making, critical thinking, communication, and relationship building skills.* Ability to work independently and in a team environment.* This position reports into Chicago.* Willingness to travel up to 10% of working time.**JOIN OUR TEAM**Do you believe in the power of innovation, collaboration, and transformation? Do you thrive in a supportive and client focused work environment? Are you looking for an opportunity to help build and drive change in a rapidly growing and evolving organization? When you join **HUB International**, you will be part of a community of learners and doers focused on our Core Values: entrepreneurship, teamwork, integrity, accountability, and service.*The expected salary range for this position is $ 100,000 to $120,000 and will be impacted by factors such as the successful candidate’s skills, experience and working location, as well as the specific position’s business line, scope and level.* *HUB International is proud to offer comprehensive benefit and total compensation packages which could include health/dental/vision/life/disability insurance, FSA, HAS and 401(k) accounts, paid-time-off benefits such as vacation, sick, personal, floating holidays and company holidays. In addition, eligible annual bonuses, equity and commissions may be available for some positions.*