Senior PAM Engineer: Privilege Access & IAM Automation

Morgan-Stanley; Boston (MA); On-site; USD 135,000 - 195,000; Full time

Job summary

Morgan Stanley is seeking a Lead Privilege Access Management Engineer to design, implement, and operate enterprise PAM across human and non-human identities. You will drive integrations with OIDC/OAuth2, SAML, SSO, FIDO2/WebAuthn, PKI, and various identity platforms in a large, global environment.

You will own PAM platforms from on-prem to cloud, enabling trusted access while enforcing least privilege. Expect on-call participation, architecture reviews, and collaboration with SREs and product

Qualifications

• 12+ years in Cyber security Engineering with hands-on principal engineering.
• Deep authentication expertise across OIDC/OAuth2, SAML, SSO, FIDO2/WebAuthn, PKI, API auth, and Unix/Linux auth at enterprise scale.
• Experience deploying PAM platforms (CyberArk) in cloud and hybrid environments.
• Mastery of Privilege Access integrations: on-prem and cloud vaults, PVWA, CPM, PSM, PTA, EPM, and related tooling.
• IAM integrations including Entra ID, Ping Identity, HashiCorp Vault, LDAP and IDM systems.
• Resiliency, automation, IaC (Terraform), CI/CD, and observability for large PAM estates.

Responsibilities

• Lead hands-on PAM engineering: design, build, integrate, and ship secure, scalable PAM solutions for humans and machines.
• Own enterprise PAM products and integrations with authentication standards (OIDC/OAuth2, SAML, SSO, FIDO2/WebAuthn, PKI).
• Deliver end-to-end integrations with multiple PAM platforms and cloud/hybrid identities.
• Scale operations with HA/DR, automation, Kubernetes deployments, and IaC tooling.
• Define policies for endpoints privilege management and audits; drive secure-by-default patterns.

Skills

PAM engineering

OIDC/OAuth2

SAML

SSO

FIDO2/WebAuthn

PKI

CyberArk

HashiCorp Vault

Entra ID

Kubernetes

Terraform

Ansible

Tools

CyberArk Vault

PVWA

PAM Tools

IDIRA PTA

Job description

Morgan Stanley is seeking a Lead Privilege Access Management Engineer to design, implement, and operate enterprise PAM across human and non-human identities. You will drive integrations with OIDC/OAuth2, SAML, SSO, FIDO2/WebAuthn, PKI, and various identity platforms in a large, global environment.

You will own PAM platforms from on-prem to cloud, enabling trusted access while enforcing least privilege. Expect on-call participation, architecture reviews, and collaboration with SREs and product