BeyondTrust Password Safe Implementation & Delivery Engineer

Role & responsibilities

Required Skills & Experience •

10+ years of overall experience in IT infrastructure, systems administration, or information security, including 5+ years of hands-on implementation experience with BeyondTrust Password Safe (or comparable PAM platforms such as CyberArk, Delinea/Thycotic, or SailPoint).

• Proven experience leading full-lifecycle PAM implementations discovery workshops, architecture design, installation, configuration, integration, migration, and go-live support.
• Strong working knowledge of Windows Server and Linux administration, SQL Server, Active Directory/LDAP, DNS, and core networking concepts.
• Hands-on scripting ability (PowerShell and/or Python) for automation, API integration, and troubleshooting.
• Solid understanding of PAM/PASM concepts: credential vaulting, session management, password/SSH key rotation, Just-in-Time access, Zero Standing Privilege, and privilege elevation.
• Experience integrating PAM platforms with SIEM, ITSM, IAM/IGA, and DevOps/CI-CD toolchains.
• Exposure to complementary BeyondTrust products (BeyondInsight, Endpoint Privilege Management/EPM, Remote Support, Privileged Remote Access) is a strong plus.
• Excellent client-facing communication skills, with the ability to lead workshops, present to security/compliance stakeholders, and write clear technical documentation.
• Preferred Certifications

BeyondTrust Certified Implementation Engineer Password Safe (Advanced preferred).

• BeyondTrust Certified Administrator Password Safe.

• Industry certifications such as CISSP, CEH, or ITIL Foundation are an advantage. Education

• Bachelors degree in Computer Science, Information Technology, or a related field, or equivalent professional experience.

Preferred candidate profile

Key Responsibilities Solution Design & Deployment

• Lead requirements-gathering and architecture design workshops with customer IT, security, and compliance stakeholders; translate requirements into a sized, documented Password Safe deployment architecture (single appliance, multi-node, HA/DR, or Cloud).

• Install and configure Password Safe and the BeyondInsight platform on-premises (including on the UVM / U Series Appliance) or provision and configure Password Safe (Cloud) tenants.

• Design and implement smart rules, discovery scans, and onboarding workflows to bring privileged accounts, service accounts, SSH keys, and assets under management. Configuration & Integration

• Credential & session management: configure password/SSH key rotation policies, check-out/check-in workflows, session monitoring, recording, locking, and termination controls.

Just-in-Time & adaptive access: implement time-, location-, and identity-based access policies and approval workflows aligned to least-privilege and Zero Standing Privilege principles.

• DevOps & application secrets: configure the Password Safe API and secrets management capabilities to remove hard-coded credentials from scripts, CI/CD pipelines, and application code.

• Integrations: connect Password Safe with Active Directory/LDAP, SIEM (Splunk, Sentinel, QRadar), ITSM (ServiceNow), IAM/IGA platforms (Entra ID, SailPoint), and RPA tools. Migration & Upgrades

• Plan and execute upgrades of existing Password Safe/BeyondInsight environments, and migrations from legacy UVM appliance hardware to current on-premises or Cloud architectures.

• Coordinate cutover, rollback, and decommissioning plans that minimize disruption to production privileged access workflows.