Principal Identity Security Engineer - Privileged Access Management (PAM)

Boston Scientific • Marlborough, MA

1d • $102,100 - $194,000 • Hybrid

About The Position

Boston Scientific is seeking a Principal Identity Security Engineer specializing in Privileged Access Management (PAM) to provide advanced technical leadership for enterprise privileged access and identity security capabilities. This highly technical individual-contributor role serves as a subject matter expert in CyberArk and related technologies, developing secure, scalable solutions across a complex global medical technology environment. The role influences technical strategy, establishes engineering standards, leads complex initiatives and collaborates with cross-functional teams to strengthen identity security and operational resilience. Solutions must balance security, patient safety, product quality, validated-system constraints and business continuity.

The position follows a hybrid work model, with employees required to work in a local office at least three days per week. Boston Scientific will not provide employment-visa sponsorship or sponsorship takeover, and relocation assistance is not available. The role is considered safety-sensitive and requires a prohibited-substance test.

Requirements

• Bachelor's degree in cybersecurity, computer science, engineering, information technology or a related discipline, or equivalent practical experience.
• At least 8 years of experience in cybersecurity engineering, identity security, security architecture, infrastructure security or a closely related technical discipline.
• At least 5 years of experience designing, implementing, integrating or supporting enterprise PAM solutions.
• Deep hands-on CyberArk expertise, including privileged account management, credential management, session monitoring, platform integration and security architecture.
• Strong knowledge of PAM architecture, identity security principles, privileged-access controls and secure authentication technologies.
• Experience designing and implementing enterprise-scale identity security solutions across on-premises, cloud and hybrid environments.
• Demonstrated experience leading complex technical projects, developing engineering standards and influencing enterprise architecture decisions.
• Strong understanding of Zero Trust, least privilege, privileged identity security, service-account management and secrets management.
• Experience implementing security controls, improving platform resilience and addressing vulnerabilities or operational risks in critical enterprise environments.
• Experience collaborating with cross-functional technology, cybersecurity and business teams to deliver complex security solutions.
• Strong analytical, troubleshooting, technical documentation and communication skills, including the ability to explain complex security concepts to technical and nontechnical stakeholders.

Nice To Haves

• Experience working in a large, global or highly regulated enterprise, particularly in medical devices, health care, life sciences, pharmaceuticals or manufacturing.
• Experience leading enterprise PAM implementations, CyberArk modernization initiatives or privileged-access recovery programs.
• Working knowledge of BeyondTrust, Delinea, Microsoft Entra Privileged Identity Management, HashiCorp Vault, One Identity or comparable identity security technologies.
• Experience securing manufacturing, operational technology, industrial control systems or validated environments.
• Knowledge of non-human identity security, service-account governance, secrets management, machine-identity controls and cloud privilege management.
• Familiarity with regulatory and security frameworks such as FDA 21 CFR Part 11, ISO 13485, IEC 62443, NIST SP 800-53, SOX and HIPAA, where applicable.
• Experience designing high-availability architectures, disaster-recovery solutions and secure emergency-access processes for critical identity platforms.
• Experience mentoring engineers, contributing to technical communities or establishing engineering best practices.
• Relevant professional certifications, including CyberArk, CISSP, CISM, CCSP, GIAC or comparable Microsoft or cloud security certifications.

Responsibilities

• Provide principal-level technical leadership for enterprise PAM, identity security architecture and privileged identity resilience.
• Design and implement secure, scalable PAM architectures, engineering standards, technical controls and modernization solutions aligned with enterprise cybersecurity objectives.
• Serve as a technical subject matter expert for CyberArk capabilities, including privileged account management, session monitoring, credential rotation, secrets management and remote access.
• Lead complex CyberArk engineering initiatives involving platform integration, upgrades, performance optimization, high availability, disaster recovery and operational resilience.
• Develop secure privileged-access patterns for administrators, service accounts, application identities, vendors, cloud workloads, databases, network devices and other critical systems.
• Evaluate complementary identity security technologies, including BeyondTrust, Delinea, Microsoft Entra Privileged Identity Management, HashiCorp Vault and emerging platforms.
• Design and advance Zero Trust controls, least-privilege access, just-in-time access, zero standing privilege and privileged identity threat detection.
• Strengthen security controls for human and non-human identities, including service, machine and application identities and emerging AI-agent identities.
• Integrate PAM with identity governance, Active Directory, Microsoft Entra ID, cloud platforms, security operations, monitoring and enterprise technology services.
• Develop privileged-access solutions for manufacturing and operational technology environments, including industrial control systems, manufacturing execution systems, laboratories and validated systems.
• Partner with Manufacturing, Quality, Infrastructure and Cybersecurity teams to implement controls while minimizing production disruption, operational risk and regulatory impact.
• Design compensating controls, secure vendor-access solutions and phased remediation approaches for legacy systems and environments with technical or validation constraints.
• Translate regulatory, audit and security requirements into practical technical controls, engineering standards and supporting documentation.
• Apply relevant cybersecurity and regulatory frameworks, including FDA requirements, ISO 13485, IEC 62443 and the NIST Cybersecurity Framework.
• Develop and validate privileged-access recovery, emergency-access and break-glass solutions to strengthen cyber resilience and business continuity.
• Provide technical expertise during significant security incidents, risk assessments, vulnerability remediation, control testing and recovery exercises.
• Establish technical health indicators and security metrics to evaluate platform effectiveness, control adoption, resilience and risk reduction.
• Troubleshoot complex identity security issues, perform root-cause analysis and implement sustainable engineering improvements.
• Collaborate with enterprise architects, cybersecurity leaders, infrastructure engineers, cloud teams and business stakeholders to align solutions with enterprise requirements.
• Mentor engineers, contribute to architecture reviews, promote engineering best practices and influence technical decisions across global teams.
• Evaluate emerging identity security technologies, threats and industry practices and recommend improvements to enterprise security capabilities.

Benefits

• Core and optional employee benefits are offered; details are referenced at www.bscbenefitsconnect.com.
• Exempt, non-sales roles may be eligible for an annual bonus target and long-term incentives, subject to plan eligibility and other requirements.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal