Sr. CyberArk PAM & EPM Implementation Engineer or Architect

Capgemini; Atlanta (GA); Presencial; USD 111.000 - 180.000; Jornada completa

Descripción de la vacante

Capgemini is seeking an experienced Senior CyberArk PAM Implementation Engineer to assess, optimize, and enhance our CyberArk PAM environment. You will define current-state architecture, identify gaps, and map a strategic roadmap across Cloud/SaaS, SIA, JIT, and EPM capabilities.

The role requires hands-on implementation, onboarding of applications and service accounts, password rotation, session access, and integration with identity platforms.

Formación

• 5–8 years hands-on CyberArk PAM implementation experience.
• Experience assessing existing CyberArk environments and defining remediation roadmaps.
• Strong Cloud/SaaS CyberArk experience and SIA/JIT knowledge.
• Experience onboarding complex apps and systems for rotation and secrets.
• Ability to integrate CyberArk with IAM, ITSM, SIEM, and cloud platforms.

Responsabilidades

• Assess current CyberArk architecture and health.
• Develop target-state CyberArk architecture and adoption roadmap.
• Implement CyberArk Cloud/SaaS, SIA, and JIT capabilities.
• Onboard applications and service accounts into CyberArk.
• Design and deploy EPM, including policy baselines.

Conocimientos

CyberArk PAM

Cloud/SaaS PAM

PAM Onboarding

JIT Access

SIA

EPM Design

PSM

REST APIs

Identity Integration

Herramientas

PowerShell

Python

REST APIs

Descripción del empleo

Choosing Capgemini means choosing a company where you will be empowered to shape your career in the way you’d like, where you’ll be supported and inspired by a collaborative community of colleagues around the world, and where you’ll be able to reimagine what’s possible. Join us and help the world’s leading organizations unlock the value of technology and build a more sustainable, more inclusive world.LocationThis role is based in the US.About The Job You're ConsideringWe are seeking an experienced Senior CyberArk PAM Implementation Engineer to assess, optimize, and enhance our existing CyberArk Privileged Access Management environment. The ideal candidate will have strong hands-on experience with CyberArk Cloud/SaaS and the ability to perform a comprehensive assessment of the existing PAM implementation, identify security and operational gaps, and develop a strategic roadmap for utilizing CyberArk capabilities to their fullest extent.This role requires deep expertise in CyberArk PAM and Endpoint Privilege Manager (EPM), Secure Infrastructure Access (SIA), Just-in-Time (JIT) privileged access, application onboarding, password rotation, privileged session access, secrets management, and cloud integrations. The successful candidate will define the current-state architecture, recommend a target-state design based on CyberArk and industry best practices, and lead or support execution of the resulting roadmap.Your Role1. Existing CyberArk Environment AssessmentPerform a comprehensive assessment of the existing CyberArk PAM environment.Review the current CyberArk architecture, configuration, integrations, policies, account onboarding processes, and operational procedures.Identify security gaps, implementation deficiencies, unused capabilities, technical debt, and opportunities for optimization.Evaluate the effectiveness of privileged account onboarding, password rotation, session management, access controls, and privileged access workflows.Assess CyberArk platform health, scalability, resilience, availability, and operational maturity.Review the existing use of CyberArk Cloud capabilities and recommend improvements.Develop a current-state assessment report, including findings, risks, recommendations, and remediation priorities.2. CyberArk Strategy and RoadmapDevelop a strategic PAM roadmap aligned with business requirements, cybersecurity objectives, and CyberArk best practices.Define a target-state CyberArk architecture and implementation plan.Develop a prioritized plan to maximize adoption and utilization of CyberArk capabilities.Create implementation phases, dependencies, milestones, and technical requirements.Define PAM use cases and prioritize systems, accounts, applications, and user populations for onboarding.Develop a PAM maturity improvement plan.3. CyberArk Cloud / PAM ImplementationImplement and optimize CyberArk Cloud/SaaS capabilities, including:Privileged account management and onboardingAccount discovery and lifecycle managementPassword rotation, verification, and reconciliationPrivileged session management and recordingPrivileged session monitoringApplication credential managementSecrets managementPrivileged access request and approval workflowsCloud infrastructure privileged accessIntegration with enterprise identity and authentication platforms4. Secure Infrastructure Access (SIA)Design, implement, and optimize CyberArk Secure Infrastructure Access (SIA).Enable secure, centralized access to infrastructure while minimizing exposure of privileged credentials.Implement secure access workflows for Windows, Linux, cloud infrastructure, and other supported platforms.Integrate SIA with enterprise identity providers and authentication mechanisms.Implement role-based access controls for infrastructure access.Develop standards and procedures for onboarding infrastructure to SIA.Evaluate existing administrative access methods and identify opportunities to reduce direct credential exposure.Key Responsibilties5.Just-in-Time (JIT) Privileged AccessDesign and implement Just-in-Time (JIT) privileged access capabilities.Implement time-bound and controlled privileged access and reduce standing privileges where feasible.Integrate JIT workflows with identity, ITSM, cloud, and authentication platforms where appropriate.Define access request, approval, elevation, expiration, and revocation workflows.Develop controls for privileged access to cloud and infrastructure environments.Monitor and optimize JIT access policies based on operational and security requirements.6.Application, System, and Account OnboardingLead onboarding of applications, systems, databases, platforms, and privileged accounts into CyberArk.Assess applications for password rotation, credential management, and secure access requirements.Configure and implement password rotation, verification, and reconciliation.Onboard service accounts and application accounts into CyberArk.Work with application owners to implement credential retrieval and secure secrets consumption.Enable users to securely access systems and administrative portals through CyberArk.Implement session management and recording for supported systems.Develop reusable onboarding patterns for Windows, Linux/Unix, databases, network devices, cloud platforms, SaaS applications, web portals, service accounts, application credentials, APIs, and machine identities.Design, implement, and optimize CyberArk Endpoint Privilege Manager (EPM) to enforce least privilege and reduce local administrator rights.Develop EPM application control and privilege elevation policies, including policy sets, rules, and baselines.Perform EPM discovery and assessment to identify excessive local administrator privileges and privilege elevation requirements.Plan and execute EPM agent deployment, phased rollout, and onboarding across Windows and supported endpoint platforms.Implement application elevation, application control, credential protection, and least-privilege policies.Define and maintain EPM policy baselines and exception management processes.Integrate EPM with enterprise identity, security monitoring, and IT operational processes where appropriate.Monitor EPM policy effectiveness, troubleshoot agent and policy issues, and continuously optimize configurations.7.Integrations and AutomationIntegrate CyberArk with enterprise identity and authentication platforms.Integrate CyberArk with cloud platforms and infrastructure services.Work with application teams to integrate applications with CyberArk secrets management capabilities.Integrate CyberArk with ITSM, SIEM, monitoring, and ticketing platforms where required.Develop automation for privileged account discovery, onboarding, reporting, and operational processes.Use PowerShell, Python, REST APIs, and CyberArk automation capabilities to improve efficiency.8.Standards, Governance, and Best PracticesDevelop CyberArk architecture standards and implementation guidelines.Define PAM onboarding standards and security requirements.Develop SOPs and operational runbooks for CyberArk administration.Define privileged account ownership and lifecycle processes.Establish policies for password rotation, reconciliation, session recording, privileged access, and emergency access.Develop privileged account inventory and classification standards.Ensure implementation aligns with CyberArk best practices and organizational security requirements.Your Skills And ExperienceTechnical RequirementsRequiredCyberArk PAM and CyberArk Cloud/SaaSPrivileged Account SecurityCentral Policy Manager (CPM)Privileged Session Manager (PSM)Privileged Session Manager for SSH (PSMP), where applicablePassword rotation and reconciliationPrivileged account onboardingApplication account and service account managementSecrets managementCyberArk Secure Infrastructure Access (SIA)Just-in-Time (JIT) privileged accessPrivileged session access and recordingREST API integrationIdentity provider integrationWindows and Linux privileged accessStrongly PreferredCyberArk Endpoint Privilege Manager (EPM) design, implementation, policy development, deployment, and operational supportPrivileged Threat Analytics (PTA), where applicable to the environmentCyberArk application access and secrets capabilitiesAWS, Microsoft Azure, and/or Google Cloud integrationKubernetes or container environmentsDevOps and CI/CD integrationsITSM and SIEM integrationsHands-on experience designing, deploying, configuring, and supporting CyberArk Endpoint Privilege Manager (EPM), including policy development, application control, privilege elevation, agent rollout, and operational optimization.Experience RequirementsMinimum of 5–8 years of hands-on CyberArk PAM implementation and engineering experience.Demonstrated experience assessing an existing CyberArk environment and developing a remediation or enhancement roadmap.Strong hands-on experience with CyberArk Cloud/SaaS.Demonstrated implementation experience with CyberArk SIA.Demonstrated implementation experience with Just-in-Time privileged access.Experience onboarding complex applications and systems for password rotation, password reconciliation, session access, privileged session management, and secrets management.Experience integrating CyberArk with enterprise applications and cloud platforms.Experience migrating or transforming legacy privileged access processes into CyberArk-based workflows.Strong understanding of privileged account lifecycle management.Experience working with application owners, infrastructure teams, cloud teams, IAM teams, and vendors.EPM operational and exception-management proceduresEPM application control and privilege elevation use-case catalogueEPM agent deployment and phased rollout planEPM policy and baseline designEPM target-state architecture and deployment strategyEPM current-state assessment and maturity reviewPreferred CertificationsRelevant CyberArk Defender certificationRelevant CyberArk Sentry certificationCyberArk Cloud-related training or certificationsCyberArk PAM implementation or delivery credentialsCISSP is beneficial but not mandatory for this hands-on engineering roleRequired DeliverablesCurrent-state CyberArk architecture assessmentCyberArk health and configuration assessmentPAM maturity and gap assessmentPrivileged account inventory and classificationTarget-state CyberArk architectureCyberArk Cloud adoption strategySIA implementation strategyJIT implementation strategyApplication and service account onboarding frameworkPassword rotation onboarding planSession access and portal access onboarding planPrioritized remediation and implementation roadmapPAM standards and operating proceduresUse-case catalogueIntegration architecture and implementation planKnowledge-transfer and operational handover documentationThe base compensation range for this role in the posted location is: $110,880 - $180,400.Capgemini provides compensation range information in accordance with applicable national, state, provincial, and local pay transparency laws. The base compensation range listed for this position reflects the minimum and maximum target compensation Capgemini, in good faith, believes it may pay for the role at the time of this posting. This range may be subject to change as permitted by law.The actual compensation offered to any candidate may fall outside of the posted range and will be determined based on multiple factors legally permitted in the applicable jurisdiction.These may include, but are not limited to: Geographic location, Education and qualifications, Certifications and licenses, Relevant experience and skills, Seniority and performance, Market and business consideration, Internal pay equity.It is not typical for candidates to be hired at or near the top of the posted compensation range.In addition to base salary, this role may be eligible for additional compensation such as variable incentives, bonuses, or commissions, depending on the position and applicable laws.Capgemini offers a comprehensive, non-negotiable benefits package to all regular, full-time employees. In the U.S. and Canada, available benefits are determined by local policy and eligibility and may include:Paid time off based on employee grade (A-F), defined by policy: Vacation: 12-25 days, depending on grade, Company paid holidays, Personal Days, Sick LeaveMedical, dental, and vision coverage (or provincial healthcare coordination in Canada)Retirement savings plans (e.g., 401(k) in the U.S., RRSP in Canada)Life and disability insuranceEmployee assistance programsOther benefits as provided by local policy and eligibilityImportant Notice: Compensation (including bonuses, commissions, or other forms of incentive pay) is not considered earned, vested, or payable until it becomes due under the terms of applicable plans or agreements and is subject to Capgemini’s discretion, consistent with applicable laws. The Company reserves the right to amend or withdraw compensation programs at any time, within the limits of applicable legislation.DisclaimersCapgemini is an Equal Opportunity Employer encouraging inclusion in the workplace. Capgemini also participates in the Partnership Accreditation in Indigenous Relations (PAIR) program which supports meaningful engagement with Indigenous communities across Canada by promoting fairness, accessibility, inclusion and respect. We value the rich cultural heritage and contributions of Indigenous Peoples and actively work to create a welcoming and respectful environment. All qualified applicants will receive consideration for employment without regard to race, national origin, gender identity/expression, age, religion, disability, sexual orientation, genetics, veteran status, marital status or any other characteristic protected by law.This is a general description of the Duties, Responsibilities and Qualifications required for this position. Physical, mental, sensory or environmental demands may be referenced in an attempt to communicate the manner in which this position traditionally is performed. Whenever necessary to provide individuals with disabilities an equal employment opportunity, Capgemini will consider reasonable accommodations that might involve varying job requirements and/or changing the way this job is performed, provided that such accommodation does not pose an undue hardship. Capgemini is committed to providing reasonable accommodation during our recruitment process. If you need assistance or accommodation, please reach out to your recruiting contact.Please be aware that Capgemini may capture your image (video or screenshot) during the interview process and that image may be used for verification, including during the hiring and onboarding process.Click the following link for more information on your rights as an Applicant in the United States. http://www.capgemini.com/resources/equal-employment-opportunity-is-the-lawCapgemini is a global business and technology transformation partner, helping organizations to accelerate their dual transition to a digital and sustainable world, while creating tangible impact for enterprises and society. It is a responsible and diverse group of 340,000 team members in more than 50 countries. With its strong over 55-year heritage, Capgemini is trusted by its clients to unlock the value of technology to address the entire breadth of their business needs. It delivers end-to-end services and solutions leveraging strengths from strategy and design to engineering, all fueled by its market leading capabilities in AI, generative AI, cloud and data, combined with its deep industry expertise and partner ecosystem.