Senior Security Engineer

Kforce Inc; San Jose (CA); On-site; USD 150,000 - 190,000; Full time

Benefits offered by this job

Medical/Dental/Vision insurance

HSA/FSA

401(k)

Job summary

Kforce Inc. seeks a security engineer to design, operate, and improve enterprise PAM capabilities across network devices, servers, cloud resources, Kubernetes, and administrative platforms.

You will own onboarding, vaulting, rotation, session management, access reviews, and break-glass processes. Responsibilities include implementing least-privilege, RBAC, JIT/JEA, and identifying unmanaged accounts, shared credentials, and excessive permissions.

Qualifications

• Bachelor's degree in Computer Science, Information Security, Engineering, or equivalent practical experience.
• 7-10 years of experience in security engineering, infrastructure security, identity security, PAM, or related disciplines.
• Strong hands-on experience implementing and operating enterprise PAM solutions in complex, large-scale production environments.
• Demonstrated ability to work across multiple engineering organizations and drive security initiatives through collaboration.

Responsibilities

• Design, operate, and continuously improve enterprise PAM capabilities across network devices, servers, cloud resources, Kubernetes, and administrative platforms
• Own privileged account onboarding, credential vaulting and rotation, session management, access reviews, recertification, and break-glass processes
• Implement least-privilege, RBAC, just-in-time, and just-enough access; identify unmanaged accounts, shared credentials, and excessive permissions
• Provide operational ownership of PAM platforms, including health, upgrades, integrations, troubleshooting, monitoring, incident support, and recovery runbooks
• Secure administrative access to routers, switches, firewalls, appliances, servers, and other infrastructure across hybrid cloud and data center environments
• Account for real-world operational needs including maintenance, fleet changes, disaster recovery, and production incident response
• Build automation using Python, Bash, APIs, and Infrastructure-as-Code tools such as Terraform to reduce manual PAM operations and enforce controls consistently
• Automate discovery, onboarding, access provisioning, entitlement validation, credential rotation, control verification, and reporting
• Integrate PAM with identity providers, CI/CD systems, cloud platforms, Kubernetes, SIEM, monitoring, vulnerability-management, and other security tooling
• Define appropriate boundaries and integrations between PAM, secrets management, PKI, and identity-management platforms, including secure credential distribution and rotation
• Act as a PAM subject-matter expert and work closely with Security, SRE, Infrastructure, Networking, DevOps, Identity, and Software Engineering teams

Skills

Privileged access management

Credential vaulting

RBAC

Just-in-time access

Just-enough access

Session management

Break-glass access

IAM

Linux administration

APIs

Security integrations

Education

Bachelor's degree in CS/Information Security/Engineering

Tools

CyberArk

BeyondTrust

Delinea

HashiCorp Vault

Kubernetes

Terraform

AWS

Azure

GCP

Job description

Responsibilities

• Design, operate, and continuously improve enterprise PAM capabilities across network devices, servers, cloud resources, Kubernetes, and administrative platforms
• Own privileged account onboarding, credential vaulting and rotation, session management, access reviews, recertification, and break-glass processes
• Implement least-privilege, RBAC, just-in-time, and just-enough access; identify unmanaged accounts, shared credentials, and excessive permissions
• Provide operational ownership of PAM platforms, including health, upgrades, integrations, troubleshooting, monitoring, incident support, and recovery runbooks
• Secure administrative access to routers, switches, firewalls, appliances, servers, and other infrastructure across hybrid cloud and data center environments
• Account for real-world operational needs including maintenance, fleet changes, disaster recovery, and production incident response
• Build automation using Python, Bash, APIs, and Infrastructure-as-Code tools such as Terraform to reduce manual PAM operations and enforce controls consistently
• Automate discovery, onboarding, access provisioning, entitlement validation, credential rotation, control verification, and reporting
• Integrate PAM with identity providers, CI/CD systems, cloud platforms, Kubernetes, SIEM, monitoring, vulnerability-management, and other security tooling
• Define appropriate boundaries and integrations between PAM, secrets management, PKI, and identity-management platforms, including secure credential distribution and rotation
• Act as a PAM subject-matter expert and work closely with Security, SRE, Infrastructure, Networking, DevOps, Identity, and Software Engineering teams

Requirements

• Bachelor's degree in Computer Science, Information Security, Engineering, or equivalent practical experience
• 7-10 years of experience in security engineering, infrastructure security, identity security, PAM, or related disciplines
• Strong hands-on experience implementing and operating enterprise PAM solutions in complex, large-scale production environments
• Demonstrated ability to work across multiple engineering organizations and drive security initiatives through collaboration

Technical Skills

• Deep understanding of privileged account lifecycle management, credential vaulting/rotation, privileged sessions, JIT/JEA, RBAC, break-glass access, service accounts, and entitlement reviews
• Experience with PAM platforms such as CyberArk, BeyondTrust, Delinea, HashiCorp Vault, or similar technologies
• Strong knowledge of authentication, authorization, IAM, least privilege, Linux administration, and secure infrastructure access
• Experience with AWS, Azure, or GCP; Docker/Kubernetes; Hybrid cloud/data center environments; Python/Bash; Terraform; APIs; and security integrations
• Understanding of networking and infrastructure security, including PKI, X.509 certificates, SSH keys, cryptography, secrets management, SIEM, monitoring, and vulnerability-management tooling

Preferred Qualifications

• Experience in a networking company, network infrastructure organization, or large-scale distributed environment such as Cisco Meraki
• Experience managing privileged access across large fleets of network devices, servers, Kubernetes clusters, and cloud resources
• Experience with Microsoft Entra ID or Okta, and technologies such as TACACS+, RADIUS, SSH, or certificate-based authentication
• Familiarity with Zero Trust, machine identity, internal security platforms, SOC 2, ISO 27001, BSI C5, Agile/DevSecOps/SRE practices, and relevant security or PAM certifications

The pay range is the lowest to highest compensation we reasonably in good faith believe we would pay at posting for this role. We may ultimately pay more or less than this range. Employee pay is based on factors like relevant education, qualifications, certifications, experience, skills, seniority, location, performance, union contract and business needs. This range may be modified in the future.

We offer comprehensive benefits including medical/dental/vision insurance, HSA, FSA, 401(k), and life, disability & ADD insurance to eligible employees. Salaried personnel receive paid time off. Hourly employees are not eligible for paid time off unless required by law. Hourly employees on a Service Contract Act project are eligible for paid sick leave.

Note: Pay is not considered compensation until it is earned, vested and determinable. The amount and availability of any compensation remains in Kforce's sole discretion unless and until paid and may be modified in its discretion consistent with the law.

This job is not eligible for bonuses, incentives or commissions.

Kforce is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status, or disability status.