CyberArk Engineer

Surrey (hybrid) | Permanent | Up to £100,000 Compensation

This is a design owner for privileged access across a hybrid estate. Cyber Ark, Active Directory, Entra , AWS, Azure. Target state, patterns, and design authority over how it gets built. Not vault administration and requires deep configuration review.

THE REMIT

• Target architecture: principles, standards, reference designs, and the transition waves to get there
• Consistent privileged access controls across on-premises infrastructure, AWS, Azure and SaaS
• Design assurance over implementation, without owning day-to-day operations
• Privileged access aligned to Zero Trust and the wider enterprise identity strategy
• Designs carried through Security, Cloud, Infrastructure and Risk without positional authority

THE PROBLEMS YOU'D INHERIT

• Rotation policy against availability where CPM aggression breaks a service account nobody documented
• PSM capacity and connection components as the estate scales, and what that does to session recording retention
• Break-glass that stays usable during an identity outage without becoming an unmonitored back door
• Cloud privileged access designed natively short-lived credentials and JIT elevation rather than static accounts pushed into a vault because that's the pattern that already exists
• Non-human identity: service accounts and secrets scaling faster than people, and the blast radius when rotation is designed badly
• Onboarding throughput, orphaned safes, and reconcile accounts that quietly stopped reconciling

REQUIRED

• Enterprise PAM target architecture you personally defined not a platform you ran
• Cyber Ark architecture and deployment, self-hosted or Privilege Cloud, with implementation oversight
• Cyber Ark Sentry or above, backed by hands-on deployment evidence
• Active Directory and Entra , with real AWS and Azure exposure
• Regulated or high-consequence control experience — risk, audit, evidence
• The ability to get a design adopted, not just approved