Lead CyberArk Engineer

Lam Research•Tualatin, OR

2d•$137,000 - $287,000•Hybrid

About The Position

The Lead CyberArk / Privileged Access Management Engineer is responsible for the architecture, engineering, delivery, and operational excellence of enterprise privileged access management, secrets management, privileged identity security, PKI, and certificate services. The role requires a seasoned security engineering professional with a track record of delivering secure, scalable, production-grade solutions in complex global environments. The engineer leads CyberArk PAM architecture, design, and platform strategy; establishes standards, deployment methods, and support processes; and designs scalable solutions for users, applications, vendors, and OT environments. The role also implements and supports CyberArk PAM, PSM, CPM, EPM, and password management services, and leads secrets management and machine identity security efforts. The position manages enterprise PKI and certificate platforms, certificate lifecycle processes, and governance for certificates, keys, and cryptographic standards. It ensures that PAM, secrets, and PKI platforms meet security and compliance requirements, supports audits, and implements least-privilege, just-in-time access, and Zero Trust controls. The engineer resolves complex platform issues; maintains monitoring, reporting, backup, and disaster recovery capabilities; improves platform performance, scalability, and security; and creates technical documentation and operational procedures. The role leads delivery from requirements through deployment and operational support, mentors engineers, and influences architecture decisions across security, identity, infrastructure, and application teams. Lam offers work-location models that vary by role. Hybrid roles may be On-site Flex, with three or more days per week onsite and the balance remote, or Virtual Flex, with one to two days per week onsite and the remainder remote. The posting does not specify which model applies to this position. The stated salary range applies only to applicants residing or working onsite in the California, San Francisco Bay Area: $137,000 to $287,000. Offers depend on factors including work location, level, education, training, skills, experience, and comparison to employees in the role.

Requirements

Bachelor's degree in Computer Science, Information Systems, Computer Engineering, Cybersecurity, or a related technical discipline.
10+ years of experience in cybersecurity, Identity and Access Management, infrastructure security, platform engineering, cloud security, or related technical disciplines.
7+ years of hands-on experience implementing and supporting CyberArk or comparable privileged access management platforms.
Demonstrated experience delivering enterprise privileged access management, secrets management, PKI, certificate lifecycle management, and machine identity security services at global scale.
Experience designing and operating highly available, mission-critical security platforms supporting infrastructure, applications, cloud, manufacturing, and business operations.
Experience leading PAM modernization initiatives, privileged identity governance programs, certificate management transformations, secrets management deployments, or cloud security projects.
Proven history delivering complex engineering projects from architecture through production implementation, transition to operations, and ongoing lifecycle support.
Experience mentoring engineers and establishing technical standards within large engineering organizations; direct people-management responsibility is not required.

Nice To Haves

Master's degree in Information Security, Cybersecurity, Engineering, or a related discipline.
CyberArk Certified Delivery Engineer (CDE).
CyberArk Certified Defender (CCD).
CyberArk Certified Sentry (CCS).
Certified Information Systems Security Professional (CISSP).
Certified Information Security Manager (CISM).
Microsoft Certified: Cybersecurity Architect Expert.
GIAC security certifications such as GSEC, GCSA, or related credentials.
PKI, cryptography, cloud security, or machine identity security certifications.

Responsibilities

Lead CyberArk PAM architecture, design, and platform strategy.
Establish PAM standards, deployment methods, and support processes.
Design scalable PAM solutions for users, applications, vendors, and OT environments, aligned with Zero Trust and cybersecurity objectives.
Implement and support CyberArk PAM, PSM, CPM, EPM, and password management services.
Manage onboarding and lifecycle of privileged accounts and systems.
Develop policies for vaulting, credential rotation, and session monitoring.
Automate onboarding, reporting, and compliance activities.
Lead CyberArk Secrets Manager deployment and support.
Design secure secret management for applications, cloud platforms, and DevOps pipelines.
Establish standards for credential rotation, authentication, and machine identities; partner with engineering teams to eliminate embedded credentials.
Manage enterprise PKI and certificate service platforms, including certificate issuance, renewal, and revocation.
Integrate certificate management with cloud, infrastructure, and application environments.
Define governance for certificates, keys, and cryptographic standards.
Ensure PAM, secrets, and PKI platforms meet security and compliance requirements; implement least-privilege, JIT access, and Zero Trust controls.
Partner with audit, risk, and security teams on remediation; support audits through reporting, evidence collection, and control validation.
Resolve complex PAM, authentication, and certificate-related issues.
Maintain monitoring, reporting, backup, and disaster recovery capabilities; improve platform performance, scalability, and security.
Create and maintain technical documentation and operational procedures.
Lead delivery from requirements through deployment and operational support.
Mentor engineers and promote engineering best practices.
Support cybersecurity, cloud, and modernization initiatives.
Influence architecture decisions across security, identity, infrastructure, and application teams.