> Markdown version of [/jobs/ext/4248253-lead-privilege-access-management-engineer](https://www.wearedevelopers.com/jobs/ext/4248253-lead-privilege-access-management-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Lead Privilege Access Management Engineer

- **Company:** Morgan Stanley
- **Location:** Boston, MA, United States
- **Experience:** Expert
- **Salary:** $135,000 - $195,000
- **Contract:** Permanent contract
- **Skills:** Microsoft Access, Application Programming Interfaces (APIs), Data Analysis, Audit Trail, User Authentication, Microsoft Azure, Software as a Service, Cloud Computing, Cyber Security, System Configuration, Continuous Integration, Data Governance, Distributed Systems, Identity and Access Management, Intrusion Detection and Prevention, Python (Programming Language), Key Management, Lightweight Directory Access Protocols (LDAP), OAuth, Open Source Technology, OpenID, Performance Tuning, Public Key Infrastructure, Windows PowerShell, Role-Based Access Control, Ansible, Security Assertion Markup Language (SAML), Single Sign-On, Software Engineering, Systems Integration, Policy as Code, Cyberark, Technical Debt, Kubernetes, Deployment Automation, Bots, Hashicorp, Puppet, SailPoint, Terraform
- **Published:** October 21, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=66b4c425264b449a

## About the Role

* Experience of 12+ years with background in Cyber security Engineering with Hands-On Principal Engineering (not architect-only): design and implement-comfortable coding, configuring, integrating products, and shipping production outcomes
 * Deep authentication expertise: OIDC/OAuth2, SAML, SSO, FIDO2/WebAuthn, PKI (CA/RA, mTLS, cert lifecycle), API auth (JWT/mTLS), and Unix/Linux authentication at enterprise scale
 * In depth experience with deploying PAM, Pcloud, Endpoint Privilege Management to Cloud and hybrid environments including Azure or GCP.
 * Privilege Access Platforms and Integration Mastery: Experience with Privilege Access solutions, Least Privilege Management with IDIRA(CyberArk) Product suites, on-Prem/Pcloud Vaults, PVWA, CPM, PSM, SIA, IDIRA EPM, IDIRA Privilege Threat Analytics (PTA), Privilege Threat detection engineering and implement use case execution for identifying both internal and external Privilege Access threats.
 * IAM platforms & integration mastery: experience with HashiCorp Vault, HSMs, CyberArk, SailPoint, Entra ID, Ping Identity, IDM/LDAP, and Integrating with Authorization solutions like Opensource Policy Agent, solutions with Rego -covering policy design, integration, automation, and migrations.
 * Resiliency and Automation at Scale: proven experience operating IAM/PAM, Endpoint Privilege Manager (SaaS), ISPSS services across large, globally distributed environments with multi-region HA/DR, performance tuning, IaC (Terraform), config management (Ansible/Puppet/Chef), CI/CD, observability; strong Shell, PowerShell plus Python.
 * Security & compliance acumen: threat modeling, least privilege, PAM, secrets management, policy-as-code, and auditability for human and non-human identities (including agentic systems).
 * Systems integrator mindset: ability to customize and stitch vendor products and open standards into cohesive, well-documented solutions and APIs.
 * Team enablement & communication: skill in decomposing solutions into clear epics/stories, authoring decision reviews/runbooks/standards, conducting reviews, coaching engineers/SREs, and producing clear written documentation to influence stakeholders in an agile squad model.
 * Enterprise & industry savvy: experience navigating large-institution environments; influencing roadmaps; driving adoption of controls and best practices; typically, 12+ years in PAM engineering within complex, global settings.

## Description

We're seeking someone to join our Identity Access Management Team to support strategic Privilege Access modernization roadmap team as Lead PAM Engineer in Cyber Data Risk & Resilience division.

Role is expected to be responsible for the design, integration, implementation, and operationalization of enterprise authentication solutions used across the Privilege Access & identity ecosystem.

What you'll do in the role:

 * Lead Hands-On PAM Engineering: design, build, integrate, and ship secure, scalable Privilege Access Management solutions for human and non-human identities (bots, service accounts, applications, agentic systems), deploying Endpoint Privilege Management controls.
 * Own Enterprise PAM products, Integration with Authentication & Federation: implement and harden Privilege Access solutions, OIDC/OAuth2, SAML, SSO, FIDO2/WebAuthn, PKI (mTLS, cert lifecycle), API auth, and Unix/Linux authentication.
 * Integrate and Customize PAM Platforms: deliver end-to-end integrations across IDIRA(CyberArk) On Prem, IDIRA(CyberArk) Pcloud, IDIRA(CyberArk) Endpoint Privilege Manager (EPM), IDIRA(CyberArk) PTA, Entra ID, Ping Identity, HashiCorp Vault, HSMs, IDM/LDAP in cloud and hybrid environments.
 * Drive Reliability and Automation at Scale: operate and evolve large-scale PAM estates with HA/DR, performance tuning, Infrastructure as a Code, Kubernetes application development and deployment, config management (Ansible/Puppet/Chef), CI/CD, observability, and safe deployment strategies.
 * Harden and Govern Identity Controls: define and enforce policies for Endpoints Privilege management with IDIRA EPM for application and binary elevations, identity lifecycle, authentication, authorization, and secrets management for human and non-human identities.
 * Assess and Uplift Existing Solutions: identify risks and technical debt, deliver remediation plans, and implement secure-by-default patterns with measurable outcomes.
 * Translate Architecture into Executable Work: break down complex designs into clear epics, stories, runbooks, and pipelines; produce Technology Architectural Design reviews, standards, and audit-ready documentation to align engineers, SREs, Product Owners, and QA.
 * Partner and Operate Across Teams: collaborating with product/platform leads to scale adoption; participate in on-call, lead RCAs, and drive operational excellence.