PAM Implementation Engineer (1099 Hourly Contract)

Airitos • Atlanta, GA

3d • Remote

About The Position

Airitos LLC is seeking a contract implementation engineer to deliver an enterprise Privileged Access Management (PAM) design and implementation for a global manufacturing client. This is a hands-on build role focused on establishing core Delinea PAM infrastructure across two Active Directory forests, onboarding privileged accounts at scale, and configuring session controls, integrations, and monitoring through handoff.

The environment is primarily on-premises, with some cloud presence. It includes Azure as the preferred cloud platform, AWS for SAP, Microsoft Entra ID (E5), Microsoft Sentinel for SIEM, and ServiceNow for ITSM. The deployment is greenfield, with no enterprise PAM currently in place.

The role is remote with little to no travel required. The engagement is expected to last approximately 10 months, with delivery continuing through 2027. Weekly hours vary from 15 to 35. The engineer reports to the Airitos IAM/PAM Architect and works with Airitos technical and process analysts, as well as the client’s infrastructure, cybersecurity, and applications teams.

Requirements

• Hands-on Delinea implementation experience, specifically with Delinea Secret Server (vault architecture, secret templates, rotation, and discovery) and the Delinea Platform.
• Working knowledge of Delinea components, including Distributed Engines, Connection Manager, session recording and monitoring, and Privilege Manager.
• Strong Windows Server and Active Directory background, including multi-forest environments; familiarity with Microsoft Entra ID.
• Experience onboarding privileged accounts and configuring rotation policies at scale, including thousands of accounts.
• PKI and certificate management, network segmentation concepts, and firewall-aware deployment across distributed sites.
• Scripting and automation experience with PowerShell and REST APIs.
• Experience integrating PAM tooling with a SIEM using syslog/CEF and with an ITSM platform for approval workflows.
• Practical understanding of tiered administration (Tier 0 through Tier 3), the Microsoft Enterprise Access Model, just-in-time access, and least privilege.

Nice To Haves

• Delinea certification (Secret Server / Platform).
• Experience implementing PAM across disconnected or untrusted multi-forest AD environments.
• Familiarity with non-human identity and secrets management, including service accounts, service principals, and DevOps secrets.
• Azure and AWS exposure; awareness of Entra PIM and how it interacts with a PAM deployment.
• ServiceNow workflow integration experience.
• Awareness of regional privacy considerations for session recording.
• Experience producing operational runbooks and transitioning day-to-day ownership to a client operations team.

Responsibilities

• Deploy and configure core Delinea infrastructure, including Secret Server and supporting components, across both forests.
• Set up web/application and database tiers, distributed engines for segmented connectivity, and certificate-based trust between systems.
• Discover, import, and vault privileged accounts and non-human identities; configure automated password rotation policies and establish and test break-glass emergency access procedures.
• Configure privileged session brokering, session recording with defined retention, and least-privilege enforcement for critical systems and applications.
• Build just-in-time access workflows tied to ServiceNow approval.
• Integrate PAM session and audit activity with Microsoft Sentinel and configure alerting.
• Support integration design and implementation for Azure and development tooling connectivity.
• Track and report onboarding volume and pace as accounts are brought under management.
• Produce operational runbooks, contribute to knowledge transfer, and support training and handoff to client staff.

What This Job Offers

• Career Level: Mid Level
• Education Level: No Education Listed