Privilege Access Management Engineer

Hub International Insurance • Chicago, IL

1d

About The Position

The Privilege Access Management Engineer implements, maintains, and develops HUB International’s privileged access management (PAM) platforms. The role focuses on automation, integration, and customization to provide robust, scalable identity services and strengthen the organization’s privileged access foundations. It contributes to information security operations, response, engineering, governance, and continuous improvement, working closely with HUB IT teams.

The engineer supports platforms including Delinea/Thycotic Secret Server, Admin by Request, and Keeper, and integrates them with SailPoint ISC and ITSM/ticketing systems. The role includes credential vaulting and rotation, privileged session monitoring, endpoint privilege elevation workflows, access certification, operational reporting, troubleshooting, technical documentation, and support for the availability and performance of identity services. The position reports into Chicago and requires willingness to travel up to 10% of working time. The posting also states availability 24/7 for critical security incident response requiring immediate resolution.

Requirements

• Bachelor’s degree in technology or applicable experience.
• At least 3 years of experience in Identity and Access Management roles.
• At least 5 years of experience with cloud infrastructure (AWS, GCP, or Azure) and O365 services and technology.
• Experience with identity protocols and technologies including SAML, OID, OAuth, SCIM, and MFA.
• Experience working with and managing Active Directory and Microsoft Entra ID.
• Experience with PowerShell, Python, shell scripting, XML, JSON, and REST/SOAP.
• Working knowledge of Active Directory, Microsoft Entra ID, and Okta.
• Knowledge of information security identity standards, principles, and practices.
• Knowledge of industry security standards, guidelines, and regulatory or compliance requirements, such as ISO 27001, NIST 800-53, SOC 2, PCI, and SOX.
• At least 3 years of hands-on experience with Delinea/Thycotic Secret Server, including vaulting, secret rotation, policy configuration, discovery, and reporting.
• Experience with Admin by Request for endpoint privilege management, including elevation request and approval workflows and application control policies.
• Experience with Keeper (Keeper Secrets Manager or Keeper Enterprise) for secrets vaulting, credential sharing, and access provisioning.
• Knowledge of just-in-time privileged access provisioning and least-privilege enforcement, including removal of standing local administrator rights.
• Experience with privileged session management, session recording and monitoring, and break-glass or emergency access account procedures.
• Experience managing service account and application-to-application credential rotation through PAM platform APIs.
• Ability to integrate PAM platforms with SailPoint ISC and ITSM or ticketing systems for unified governance and audit reporting.
• Prioritization, decision-making, critical-thinking, communication, and relationship-building skills.
• Ability to work independently and in a team environment.
• Willingness to travel up to 10% of working time.

Nice To Haves

• Related certifications such as GSEC, CISSP, GIAC, or AWS.

Responsibilities

• Manage assigned projects and contribute to their successful completion.
• Support the Security Support and Identity Operations Team in maintaining the security integrity of HUB’s PAM application suite.
• Be available 24/7 for critical security incident response requiring immediate resolution.
• Help ensure identity security tooling is operational and meets required service and availability levels.
• Contribute to identity operations KPIs and weekly and monthly posture and identity operations reporting.
• Maintain knowledge of identity, authentication, authorization, and governance technologies and techniques, and propose modernization and improvement ideas.
• Support practices and processes that enable rapid identification of security events and mitigation of risk.
• Engage with peers on security operations, project status, activities, and achievements.
• Contribute to continuous improvement of information security identity tooling and systems.
• Help plan, organize, and execute responsibilities to achieve project goals, and provide technical leadership to move operational projects to completion.
• Contribute to security requirements, standards, procedures, and reference architectures that comply with policies and technical standards.
• Contribute to identity management analysis, governance, and certification operations.
• Create and maintain technical documentation, including solution architecture, process flows, and configuration guides.
• Troubleshoot PAM-related issues and support high availability and performance of identity services.
• Analyze and recommend upgrades, changes, and implementations to support and scale identity operations.
• Implement, administer, and maintain Delinea/Thycotic Secret Server, Admin by Request, and Keeper.
• Manage credential vaulting, automated secret rotation, and session recording and monitoring in Secret Server.
• Manage lifecycle processes and certification campaigns for privileged credentials and secrets.
• Design and maintain endpoint privilege elevation workflows and approval chains using Admin by Request.
• Administer role-based access and shared credential structures within Keeper.
• Integrate PAM platforms with SailPoint ISC for privileged account discovery and access certification.

Benefits

• Health, dental, vision, life, and disability insurance.
• Flexible spending account (FSA) and health savings account (HSA).
• 401(k) accounts and retirement savings matching.
• Paid time off, including vacation, sick, personal, floating holidays, and company holidays.
• Paid parental leave.
• Wellbeing program.
• Company-paid life and disability plans.
• Eligible annual bonuses, equity, and commissions may be available for some positions.
• Structured training, licensing support, and ongoing development opportunities.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level