Security Engineer (CyberArk)

About the role

The Security Engineer is mainly responsible for the end-to-end implementation, integration, and operationalization of CyberArk (On-Prem and Cloud) Privileged Access Management (PAM), Venafi Machine Identity Management and 2FA (such as RSA, SecurEnvoy, Cisco Duo) solutions across enterprise environments. This role focuses on deployment, migration, onboarding, and integration of privileged access controls, certificates, and machine identities in line with security best practices. The Security Engineer will work closely with architects, project managers, and customer stakeholders to deliver secure, scalable, and compliant PAM, CLM and 2FA solutions.

Key responsibilities

• Install, configure, and harden CyberArk components: Enterprise Password Vault (EPV), Central Policy Manager (CPM), Privileged Session Manager (PSM), Password Vault Web Access (PVWA), Privileged Threat Analytics (PTA), Privilege Cloud Connector, CyberArk Adaptive Multi-Factor Authentication (MFA), CyberArk Vendor Privileged Access Manager (Vendor PAM)
• Install and configure 2FA solutions such as RSA, SecurEnvoy, Cisco Duo
• Develop and maintain PSM and CPM connectors
• Execute full-cycle deployment activities: infrastructure build, installation & configuration, system validation and testing
• Ensure adherence to CyberArk as well as RSA/SecurEnvoy best practices for installation, configuration, and testing
• Install, configure, and administer Venafi TLS Protect platform
• Design and document Venafi architecture
• Configure machine identity lifecycle management, including certificate discovery, inventory management, and automation workflows
• Perform CyberArk environment migrations (on-prem to on-prem / cloud / SaaS) and execute version upgrades and platform transitions
• Onboard privileged accounts, systems, and applications into CyberArk and configure password policies, rotation and reconciliation settings, access controls and role-based permissions

About you

• CyberArk Certified Delivery Engineer (CDE-PAM / Privilege Cloud) - mandatory
• Strong hands-on deployment experience with EPV, CPM, PSM, PVWA, PTA, Privilege Cloud Connector, CyberArk Vendor Privileged Access Manager (Vendor PAM), Cyberark MFA, RSA Authentication Manager, SecurEnvoy
• Solid understanding of Windows Server & Linux (RHEL), Active Directory / LDAP, Networking (firewalls, ports, VPN), and Scripting
• Knowledge in IAM, Security Best Practices and Zero Trust Methodologies
• Experience in large-scale enterprise deployments (500+ systems onboarding) - preferred
• Venafi TLS Protect Certification - preferred
• Venafi Machine Identity Management Certification - preferred
• Strong stakeholder engagement & communication skills
• Ability to lead technical workshops and discussions
• Structured and documentation-driven mindset
• Experience working in project-based delivery environments