Sr. CyberArk PAM & EPM Implementation Engineer or Architect

Capgemini • Atlanta, GA

2d

About The Position

Capgemini is seeking a senior CyberArk PAM implementation professional to assess, optimize, and enhance an existing privileged access management environment. The role requires hands-on experience with CyberArk Cloud/SaaS and expertise across CyberArk PAM, Endpoint Privilege Manager (EPM), Secure Infrastructure Access (SIA), Just-in-Time (JIT) privileged access, application onboarding, password rotation, privileged session access, secrets management, and cloud integrations. The position will assess the current architecture and operations, identify risks and gaps, define a target-state design, and lead or support delivery of a prioritized implementation roadmap. The role is based in the United States.

The engineer or architect will assess CyberArk platform health, configuration, integrations, policies, onboarding processes, operational procedures, scalability, resilience, and maturity. They will develop findings and recommendations, set PAM strategy and standards, and implement or optimize CyberArk Cloud/SaaS capabilities, SIA, JIT access, account and application onboarding, session management, secrets management, and EPM controls. They will also develop integrations and automation, establish governance and operational practices, and produce architecture, assessment, implementation, and handover deliverables.

The posted base compensation range is $110,880–$180,400. The role may be eligible for variable incentives, bonuses, or commissions. Capgemini describes a comprehensive benefits package for regular, full-time employees; availability depends on local policy and eligibility and may include paid time off, holidays, personal days, sick leave, medical, dental and vision coverage, retirement savings plans, life and disability insurance, and employee assistance programs.

Requirements

• At least 5–8 years of hands-on CyberArk PAM implementation and engineering experience.
• Strong hands-on experience with CyberArk Cloud/SaaS.
• Demonstrated experience assessing an existing CyberArk environment and developing a remediation or enhancement roadmap.
• Demonstrated implementation experience with CyberArk Secure Infrastructure Access (SIA).
• Demonstrated implementation experience with Just-in-Time privileged access.
• Experience onboarding complex applications and systems for password rotation, password reconciliation, session access, privileged session management, and secrets management.
• Experience integrating CyberArk with enterprise applications and cloud platforms.
• Experience migrating or transforming legacy privileged access processes into CyberArk-based workflows.
• Strong understanding of privileged account lifecycle management.
• Experience working with application owners, infrastructure teams, cloud teams, IAM teams, and vendors.
• Knowledge or experience with CyberArk PAM and Cloud/SaaS, Privileged Account Security, Central Policy Manager (CPM), Privileged Session Manager (PSM), and Privileged Session Manager for SSH (PSMP), where applicable.
• Experience with password rotation and reconciliation, privileged account onboarding, application and service account management, secrets management, REST API integration, identity-provider integration, and Windows and Linux privileged access.
• EPM operational and exception-management procedures, application control and privilege-elevation use cases, agent deployment and phased rollout, policy and baseline design, target-state architecture and deployment strategy, and current-state assessment and maturity review are listed as experience requirements.

Nice To Haves

• CyberArk Endpoint Privilege Manager (EPM) design, implementation, policy development, deployment, and operational support.
• CyberArk Privileged Threat Analytics (PTA), where applicable to the environment.
• CyberArk application access and secrets capabilities.
• AWS, Microsoft Azure, and/or Google Cloud integration.
• Kubernetes or container environments.
• DevOps and CI/CD integrations.
• ITSM and SIEM integrations.
• Relevant CyberArk Defender certification.
• Relevant CyberArk Sentry certification.
• CyberArk Cloud-related training or certifications.
• CyberArk PAM implementation or delivery credentials.
• CISSP; beneficial but not mandatory.

Responsibilities

• Assess the existing CyberArk PAM architecture, configuration, integrations, policies, onboarding processes, operational procedures, platform health, scalability, resilience, availability, and maturity.
• Identify security and operational gaps, implementation deficiencies, unused capabilities, technical debt, optimization opportunities, and remediation priorities; document findings in a current-state assessment.
• Develop a strategic PAM roadmap, target-state architecture, implementation plan, phases, dependencies, milestones, technical requirements, and prioritized onboarding plan.
• Implement and optimize CyberArk Cloud/SaaS capabilities for privileged account management, discovery and lifecycle management, password rotation and reconciliation, session management and recording, application credentials, secrets, workflows, cloud infrastructure access, and enterprise identity integrations.
• Design, implement, and optimize CyberArk Secure Infrastructure Access (SIA), including secure infrastructure access workflows, identity-provider integrations, role-based access controls, onboarding standards, and approaches to reduce direct credential exposure.
• Design and implement JIT privileged access, including time-bound access, request and approval workflows, elevation, expiration, revocation, integrations, and policy monitoring and optimization.
• Lead onboarding of applications, systems, databases, platforms, service accounts, application accounts, and privileged accounts into CyberArk; implement credential management, password rotation, reconciliation, session management, recording, and secure secrets consumption.
• Design and operate CyberArk EPM, including discovery, application control, privilege elevation, least-privilege policies, baselines, exception management, agent deployment, phased rollout, troubleshooting, monitoring, and continuous optimization.
• Integrate CyberArk with identity and authentication platforms, cloud and infrastructure services, applications, ITSM, SIEM, monitoring, and ticketing systems as required.
• Develop automation for discovery, onboarding, reporting, and operations using PowerShell, Python, REST APIs, and CyberArk automation capabilities.
• Develop architecture standards, implementation guidelines, onboarding standards, security requirements, SOPs, operational runbooks, account ownership and lifecycle processes, password and session policies, emergency-access policies, and inventory and classification standards.
• Produce required deliverables, including architecture and health assessments, PAM maturity and gap assessments, account inventories, target-state architecture, adoption and implementation strategies, onboarding frameworks, remediation roadmaps, standards, integration plans, use-case catalogues, and knowledge-transfer documentation.
• Work with application owners, infrastructure teams, cloud teams, IAM teams, and vendors to assess needs and deliver CyberArk implementations.

Benefits

• Paid time off, including vacation of 12–25 days depending on employee grade, company-paid holidays, personal days, and sick leave, subject to policy and eligibility.
• Medical, dental, and vision coverage, or provincial healthcare coordination in Canada, subject to local policy and eligibility.
• Retirement savings plans, such as 401(k) in the U.S. or RRSP in Canada, subject to local policy and eligibility.
• Life and disability insurance, subject to local policy and eligibility.
• Employee assistance programs, subject to local policy and eligibility.
• The role may be eligible for variable incentives, bonuses, or commissions depending on position and applicable laws.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed