PAM Engineer

This is a Python automation engineer who works in privileged access management (PAM), not a pure CyberArk administrator.

Companies have powerful accounts (admin logins, database credentials, service accounts) that could give an attacker access to everything if stolen. PAM locks those accounts in a secure vault, controls who can use them, records what they do, and rotates the passwords automatically. This person keeps that system running and writes code so it runs with less manual effort.

Who this person is, in one sentence: a security-minded software or systems engineer who understands identity and access, writes solid Python, and can run their own projects, ideally with some CyberArk experience.

What they’d do day to day

The job splits into four kinds of work:

1. Operate the PAM environment: onboard accounts into the vault, fix things that break, handle access requests, and keep the system healthy.
2. Automate: write Python (plus PowerShell or Bash) scripts and integrations so tasks once done by hand happen automatically.
3. Run projects independently: take an assignment from kickoff to delivery without much hand-holding.
4. Integrate systems: connect the PAM tool to identity platforms such as Okta or Microsoft Entra ID through APIs.

CyberArk is the product this client uses; the rest of the terms below are its parts or the systems it connects to.

Programming ability and independent delivery are the real core; CyberArk is a bonus, and the long bullet list is a wish list that almost no one fully matches.

• Programming is the core. Python is the first bullet, and the posting repeats “independent” and “end-to-end” several times. They want a builder who owns outcomes, not only an administrator.
• CyberArk is “preferred, not mandatory.” A strong Python and identity/security engineer who can learn CyberArk is acceptable. This is the biggest lever for widening the candidate pool.
• Treat most of the list as bonuses. Screen hard on the must-haves below and weigh the rest as differentiators.

Must-haves (screen hard)

• Production Python, with design, debugging, and maintenance owned independently
• Independent end-to-end project delivery
• REST API design, integration, and security
• IAM and privileged access fundamentals, plus AD/LDAP and authentication protocols (Kerberos, SAML, OIDC)
• Git, plus PowerShell or Bash scripting

Strong differentiators

• Hands-on CyberArk experience (PVWA, CPM, PSM, Digital Vault), especially the CyberArk REST API and CPM plugin or PSM connector development
• Okta, Entra ID, or Auth0 integration experience
• Applied AI/LLM work in security operations, such as log analysis, anomaly detection, or risk scoring