Privilege Access Management Engineer

HUB International • Chicago, IL

2d • $100,000 - $120,000

About The Position

The Security Identity PAM Engineer implements, maintains, and develops HUB International’s Privileged Access Management platforms. The role focuses on automation, integration, and customization to provide robust, scalable identity services, and contributes to information security operations, incident response, operational engineering, tooling maintenance, and security programs. It works closely with HUB IT teams to support effective information security operations.

The engineer contributes to security support and identity operations, maintains the integrity and availability of PAM applications, supports assigned projects, and participates in critical security incident response. The position also contributes to identity operations reporting and KPIs, technical documentation, governance and certification activities, continuous improvement, and security standards and procedures. It reports into Chicago and may require travel up to 10% of working time.

Requirements

• Bachelor’s degree in technology or applicable experience.
• At least 3 years of experience in Identity and Access Management roles.
• At least 5 years of experience with cloud infrastructure (AWS, GCP, or Azure) and O365 services and technology.
• Experience with SAML, OID, OAuth, SCIM, and MFA.
• Experience managing Active Directory and MS Entra ID.
• Experience with PowerShell, Python, shell scripting, XML, JSON, and REST/SOAP.
• Working knowledge of Active Directory, MS Entra ID, and Okta.
• Knowledge of information security identity standards, principles, and practices.
• Knowledge of security standards, guidelines, and regulatory or compliance requirements such as ISO 27001, NIST 800-53, SOC 2, PCI, and SOX.
• At least 3 years of hands-on experience with Delinea/Thycotic Secret Server, including vaulting, secret rotation, policy configuration, discovery, and reporting.
• Experience with Admin by Request for endpoint privilege management, including elevation request and approval workflows and application control policies.
• Experience with Keeper (Keeper Secrets Manager or Keeper Enterprise) for secrets vaulting, credential sharing, and access provisioning.
• Knowledge of just-in-time privileged access provisioning and least-privilege enforcement, including removal of standing local administrator rights.
• Experience with privileged session management, session recording and monitoring, and break-glass or emergency-access account procedures.
• Experience managing service-account and application-to-application credential rotation through PAM platform APIs.
• Ability to integrate PAM platforms with SailPoint ISC and ITSM or ticketing systems for unified governance and audit reporting.
• Prioritization, decision-making, critical-thinking, communication, and relationship-building skills.
• Ability to work independently and in a team environment.

Nice To Haves

• Related certifications such as GSEC, CISSP, GIAC, or AWS.

Responsibilities

• Manage assigned projects and contribute to their successful completion, providing technical leadership to move operational projects forward.
• Maintain the security integrity, availability, and performance of HUB’s privileged access management applications and identity services.
• Participate in critical security incident response, including availability 24/7 for incidents requiring immediate resolution.
• Contribute to identity operations KPIs, weekly and monthly posture reporting, and identity operations reporting.
• Maintain current knowledge of identity, authentication, authorization, and governance technologies and recommend modernization and improvement opportunities.
• Contribute to rapid identification of security events and practices that mitigate risk.
• Collaborate with peers and HUB IT teams on security operations, project status, activities, and achievements.
• Contribute to continuous improvement of information security identity tools and systems, as well as security requirements, standards, procedures, and reference architectures.
• Perform identity management analysis, governance, and certification operations.
• Create and maintain technical documentation, including solution architecture, process flows, and configuration guides.
• Troubleshoot PAM-related issues and recommend upgrades, changes, and implementations to support and scale identity operations.
• Implement, administer, and maintain HUB’s PAM platforms, including Delinea/Thycotic Secret Server, Admin by Request, and Keeper.
• Manage credential vaulting, automated secret rotation, and session recording and monitoring within Secret Server.
• Manage the lifecycle and certification campaigns for privileged credentials and secrets.
• Design and maintain endpoint privilege elevation workflows and approval chains using Admin by Request.
• Administer role-based access and shared credential structures within Keeper.
• Integrate PAM platforms with SailPoint ISC to support privileged account discovery and access certification.

Benefits

• Comprehensive health, dental, vision, life, and disability insurance.
• Flexible spending account (FSA).
• 401(k) accounts and retirement savings matching.
• Paid time off, including vacation, sick, personal, floating holidays, and company holidays.
• Paid parental leave.
• Wellbeing program.
• Company-paid life and disability plans.
• Eligible annual bonuses, equity, and commissions may be available for some positions.
• Structured training, licensing support, and ongoing development opportunities.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level