Senior Identity Security Engineer

CPKC•Kansas City, MO

1d•Onsite

About The Position

As a Senior Specialist, Enterprise Security, this role supports CPKC’s identity security strategy and protects critical systems through CyberArk Privileged Access Management (PAM), Identity and Access Management (IAM), Identity Governance and Administration (IGA), and Public Key Infrastructure (PKI). The position works with cybersecurity technologies, contributes to enterprise security standards, and leads initiatives that strengthen regulatory compliance, operational resilience, and cyber defense. It focuses on securing privileged access, improving identity governance, managing digital trust through PKI, and supporting secure business operations.

Requirements

Minimum high school diploma or GED, or an equivalent combination of education and relevant experience in cybersecurity, IAM, PAM, IGA, PKI, or related technology disciplines.
10+ years of experience in cybersecurity, IAM, PAM, identity governance, or related security disciplines.
Experience administering CyberArk PAM solutions in large, complex enterprise environments.
Hands-on experience with IAM and IGA platforms such as SailPoint, Saviynt, Microsoft Entra ID, Okta, or Ping Identity, including identity lifecycle management, access provisioning, access certifications, RBAC, and segregation-of-duties controls.
Experience supporting PKI and certificate lifecycle management, including SSL/TLS certificates, Microsoft Certificate Services, public certificate authorities, cryptographic security controls, and identity integrations with Active Directory, Entra ID/Azure AD, LDAP, cloud platforms, applications, databases, and network devices.
Proficiency with PowerShell, Python, REST APIs, and automation tools.
Experience with authentication protocols including SAML, OAuth 2.0, OpenID Connect, Kerberos, RADIUS, and SCIM.
Experience supporting audit, compliance, and SOX requirements.
Ability to meet the negative company drug test and background investigation requirements, including criminal history check, education verification, professional references, and Social Security Number verification.
Potential requirement to obtain or maintain conductor or locomotive engineer certification or qualification, as applicable to the management conductor program.

Nice To Haves

Industry certifications such as CyberArk Defender, CyberArk Sentry, CISSP, CISM, Security+, Microsoft Identity, SailPoint, or PKI-related certifications are considered an asset.

Responsibilities

Administer, maintain, upgrade, and optimize the CyberArk PAM platform, including Vault, CPM, PSM, PWA, PTA, account onboarding, credential management, password rotation, privileged session management, just-in-time access, and privileged access workflows.
Design, support, and troubleshoot CyberArk integrations with Windows, Linux/UNIX, databases, network devices, cloud platforms, directory services, SaaS applications, and other enterprise technologies; develop custom connectors, scripts, APIs, and automation solutions.
Support enterprise IAM capabilities, including identity lifecycle management, provisioning and deprovisioning, authentication, authorization, federation, SSO, MFA, conditional access, and integrations with Active Directory, Entra ID, LDAP, HR systems, cloud services, and business applications.
Support IGA initiatives, including access request workflows, certifications, access reviews, RBAC, ABAC, segregation of duties, joiner-mover-leaver processes, entitlement management, role governance, and remediation of access-control risks.
Manage and support enterprise PKI services, including certificate authorities, certificate lifecycle management, issuance, renewal, deployment, monitoring, revocation, SSL/TLS troubleshooting, key management, and protection of cryptographic assets across on-premises and cloud environments.
Monitor, analyze, and resolve identity and access-related incidents; perform root cause analysis, vulnerability remediation, platform health monitoring, security reviews, and continuous improvement activities.
Support audit, compliance, and governance requirements through audit-ready documentation, evidence collection, reporting, control validation, SOX compliance activities, access certifications, privileged access reviews, and adherence to security frameworks and regulatory standards.
Collaborate with security, infrastructure, application, compliance, audit, and business teams to enhance PAM, IAM, IGA, and PKI programs.
Maintain technical documentation, runbooks, training materials, change management activities, and disaster recovery processes, and stay aware of emerging cybersecurity trends and best practices.
Meet pre-employment requirements, including a negative company drug test and background investigation.
Be prepared for the possibility that the position location may change based on organizational requirements.
A management employee may be required to obtain or maintain conductor or locomotive engineer certification or qualification.