Sr. CyberArk Implementation Engineer or Architect

Capgemini • Atlanta, GA

1d • $110,880 - $180,400

About The Position

Capgemini is seeking an experienced Senior CyberArk PAM Implementation Engineer to assess, optimize, and enhance its existing CyberArk Privileged Access Management environment. The role calls for hands-on expertise with CyberArk Cloud/SaaS and responsibility for assessing the current implementation, identifying security and operational gaps, and developing a roadmap to make effective use of CyberArk capabilities.

The position covers CyberArk PAM and Endpoint Privilege Manager (EPM), Secure Infrastructure Access (SIA), Just-in-Time (JIT) privileged access, application onboarding, password rotation, privileged session access, secrets management, and cloud integrations. The successful candidate will document the current-state architecture, recommend a target-state design informed by CyberArk and industry best practices, and lead or support execution of the roadmap.

The role includes assessment and strategy work, implementation and optimization of CyberArk Cloud/SaaS capabilities, SIA and JIT access, onboarding of applications and privileged accounts, EPM policy and deployment work, enterprise integrations and automation, and development of standards, governance practices, and operational documentation. Required deliverables include architecture and health assessments, maturity and gap assessments, account inventory and classification, target-state and integration plans, implementation strategies, a prioritized roadmap, standards, procedures, use-case catalogues, and knowledge-transfer documentation.

Requirements

• Minimum of 5–8 years of hands-on CyberArk PAM implementation and engineering experience.
• Strong hands-on experience with CyberArk Cloud/SaaS.
• Demonstrated experience assessing an existing CyberArk environment and developing a remediation or enhancement roadmap.
• Demonstrated implementation experience with CyberArk SIA.
• Demonstrated implementation experience with Just-in-Time privileged access.
• Experience onboarding complex applications and systems for password rotation, reconciliation, session access, privileged session management, and secrets management.
• Experience integrating CyberArk with enterprise applications and cloud platforms.
• Experience migrating or transforming legacy privileged access processes into CyberArk-based workflows.
• Strong understanding of privileged account lifecycle management.
• Experience working with application owners, infrastructure teams, cloud teams, IAM teams, and vendors.
• Knowledge of CyberArk PAM and Cloud/SaaS, privileged account security, Central Policy Manager (CPM), Privileged Session Manager (PSM), PSMP where applicable, password rotation and reconciliation, account onboarding, application and service account management, secrets management, SIA, JIT access, session access and recording, REST API integration, identity-provider integration, and Windows and Linux privileged access.
• EPM operational and exception-management procedures, application control and privilege-elevation use cases, agent deployment and phased rollout, policy and baseline design, target-state architecture and deployment strategy, and current-state assessment and maturity review.
• Relevant CyberArk Defender certification, CyberArk Sentry certification, CyberArk Cloud-related training or certifications, or CyberArk PAM implementation or delivery credentials are listed as preferred certifications.
• CISSP is beneficial but not mandatory for this hands-on engineering role.

Nice To Haves

• CyberArk Endpoint Privilege Manager (EPM) design, implementation, policy development, deployment, and operational support.
• Privileged Threat Analytics (PTA), where applicable to the environment.
• CyberArk application access and secrets capabilities.
• AWS, Microsoft Azure, and/or Google Cloud integration.
• Kubernetes or container environments.
• DevOps and CI/CD integrations.
• ITSM and SIEM integrations.
• Hands-on experience designing, deploying, configuring, and supporting CyberArk EPM, including policy development, application control, privilege elevation, agent rollout, and operational optimization.
• Relevant CyberArk Defender certification.
• Relevant CyberArk Sentry certification.
• CyberArk Cloud-related training or certifications.
• CyberArk PAM implementation or delivery credentials.
• CISSP.

Responsibilities

• Assess the existing CyberArk PAM environment, including architecture, configuration, integrations, policies, onboarding processes, operational procedures, platform health, scalability, resilience, availability, and operational maturity.
• Identify security gaps, implementation deficiencies, unused capabilities, technical debt, and optimization opportunities; deliver findings, risks, recommendations, and remediation priorities.
• Develop a strategic PAM roadmap aligned with business requirements, cybersecurity objectives, and CyberArk best practices, including target-state architecture, implementation phases, dependencies, milestones, technical requirements, and maturity improvements.
• Prioritize systems, accounts, applications, and user populations for PAM onboarding and maximize adoption of CyberArk capabilities.
• Implement and optimize CyberArk Cloud/SaaS capabilities for account management and onboarding, discovery and lifecycle management, password rotation and reconciliation, session management and recording, application credentials, secrets, access workflows, cloud access, and identity integrations.
• Design, implement, and optimize CyberArk Secure Infrastructure Access (SIA), including secure access workflows, identity-provider integrations, role-based access controls, onboarding standards, and measures to reduce direct credential exposure.
• Design and implement Just-in-Time privileged access, including time-bound access, request and approval, elevation, expiration, revocation, and integrations with identity, ITSM, cloud, and authentication platforms; monitor and optimize policies.
• Lead onboarding of applications, systems, databases, platforms, privileged accounts, service accounts, and application accounts into CyberArk; configure password rotation, verification, reconciliation, secure secrets consumption, and session management.
• Design and optimize CyberArk Endpoint Privilege Manager (EPM), including least-privilege policies, application control, privilege elevation, discovery, agent deployment, phased rollout, baselines, exception management, integrations, troubleshooting, and ongoing optimization.
• Integrate CyberArk with enterprise identity and authentication platforms, cloud platforms, infrastructure services, applications, ITSM, SIEM, monitoring, and ticketing systems as required.
• Develop automation for account discovery, onboarding, reporting, and operations using PowerShell, Python, REST APIs, and CyberArk automation capabilities.
• Develop CyberArk architecture standards, implementation guidelines, onboarding and security requirements, administration SOPs and runbooks, ownership and lifecycle processes, and policies for rotation, reconciliation, session recording, privileged access, and emergency access.
• Produce required deliverables, including current- and target-state assessments and architecture, account inventory and classification, adoption and implementation strategies, onboarding frameworks, remediation roadmap, operating procedures, integration plans, use-case catalogue, and operational handover documentation.
• Work with application owners, infrastructure teams, cloud teams, IAM teams, and vendors to deliver CyberArk implementations and transformations.

Benefits

• Paid time off: vacation of 12–25 days depending on employee grade, company-paid holidays, personal days, and sick leave.
• Medical, dental, and vision coverage, subject to local policy and eligibility.
• Retirement savings plans, including 401(k) in the U.S. and RRSP in Canada.
• Life and disability insurance.
• Employee assistance programs.
• Other benefits as provided by local policy and eligibility.
• The role may be eligible for variable incentives, bonuses, or commissions depending on the position and applicable laws.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed