We are seeking an experienced and highly skilled CyberArk Architect to lead the architecture, design, and continuous implementation of our enterprise Privileged Access Management (PAM) program. In this role, you will be responsible for defining the strategy, roadmap, deployment models, and integration of CyberArk solutions across multi-cloud, hybrid, and on-premises environments.
You will work closely with enterprise infrastructure teams, security operations, cloud engineering, and compliance stakeholders to secure privileged credentials, manage secret store integration, and enforce least-privilege principles across the organization.
Lead the end-to-end architecture, technical design, roadmap, and implementation strategy for the enterprise CyberArk PAM platform.
High Availability (HA) & Disaster Recovery (DR) design for CyberArk infrastructure across multi-site and multi-cloud environments.
Define policies and best practices for Privileged Account Discovery, Credential Rotation, Session Monitoring, and Secrets Management.
Standardize privileged access workflows, vaulting criteria, approval mechanisms, and emergency access (break-glass) procedures.
< class="" data-path-to-node="15">2. CyberArk Core Deployment & Integration</>Design, configure, and optimize CyberArk Core PAS components:
Enterprise Password Vault (EPV)
Central Policy Manager (CPM)
Privileged Session Manager (PSM / PSMP)
Password Vault Web Interface (PVWA)
Architect and implement CyberArk Conjur Enterprise / Secrets Manager for DevOps tools (CI/CD pipelines, Ansible, Terraform, Kubernetes).
Implement Endpoint Privilege Manager (EPM) for workstations and servers to control local admin rights and enforce application control.
Configure CyberArk Alero / Remote Access for secure vendor and third-party privileged access.
Integrate CyberArk with core infrastructure and security solutions:
Directory Services: Active Directory (AD), Azure AD / Entra ID, LDAP.
SIEM / Monitoring: Splunk, QRadar, Microsoft Sentinel.
ITSM / Governance: ServiceNow (change management/ticketing integration), SailPoint/IdentityIQ.
MFA / SSO: Okta, Ping, Duo, Microsoft Entra ID.
< class="" data-path-to-node="17">3. Operations, Automation & Security Engineering</>Develop custom Central Policy Manager (CPM) plugins, Password Upload Utility scripts, and REST API integrations (using Python, PowerShell, or Bash) to automate onboarding and secret management.
Monitor CyberArk system health, performance metrics, and capacity planning.
Oversee vault upgrades, patch management, platform migration, and hardening according to CyberArk Security Hardening Guidelines.
Support audit, compliance, and risk management requirements (e.g., SOC 2, ISO 27001, PCI-DSS, HIPAA, NIST 800-53) by generating privileged account usage reports and evidence logs.
Education: Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or equivalent work experience.
Experience:
12+ years of total experience in Information Security and Identity & Access Management (IAM).
5+ years of dedicated, hands-on experience designing and deploying enterprise CyberArk PAM solutions.
CyberArk Certifications:
CyberArk Certified Delivery Engineer (CDE) or CyberArk Certified Defender / Sentry / Guardian (Strongly Preferred).
Technical Proficiency:
Advanced knowledge of CyberArk PAS architecture (Vault, CPM, PSM, PVWA, Conjur, EPM, Alero).
Strong scripting skills in PowerShell, Python, or REST API automation.
Deep understanding of Active Directory, Kerberos, LDAP, Group Policy (GPO), and Windows Server / Linux administration.
Experience with cloud platforms (AWS, Azure, Google Cloud Platform) and securing cloud-native IAM architectures.
Familiarity with containerization (Docker, Kubernetes) and CI/CD pipelines (Jenkins, GitLab, Azure DevOps).
Excellent problem-solving, analytical, and troubleshooting skills.
Strong written and verbal communication skills with the ability to articulate technical security concepts to non-technical business stakeholders.
Proven leadership capability to mentor junior PAM engineers and guide cross-functional teams.
CISSP, CISM, CCSP, or AWS/Azure Solutions Architect certifications.
Hands-on experience migrating on-premises CyberArk deployments to CyberArk Privilege Cloud (SaaS).
