Security PAM Engineer

Role overview

Design and deliver privileged account lifecycle management for an enterprise environment, with a focus on automating the governance of service accounts. The work spans configuring a privileged access management platform, integrating it with directory and vault systems, and taking a pilot through production rollout. This is an initial six-month contract, with potential for full-time conversion based on performance and milestones.

Responsibilities - Configure and optimize lifecycle management engines to meet enterprise security requirements. - Integrate workflows with on-premises or hybrid directory services and existing secret vaults. - Pilot automated management for 10 critical service accounts, then onboard a further 25 after validation. - Automate account creation, discovery, credential rotation, privileged elevation, and deprovisioning. - Produce architecture records, configuration guides, runbooks, and support handover materials. - Work with security, identity, and systems teams to support compliance, auditability, and reliable operations.

Requirements - At least five years of information security experience focused on identity and privileged access management. - At least three years deploying and administering Delinea Secret Server. - Experience implementing account lifecycle management or comparable privileged service account governance. - Strong knowledge of Active Directory, LDAP, Kerberos, group policies, and service accounts or principals. - Experience connecting privileged access vaults to directories, SIEM systems, and infrastructure endpoints. - Ability to troubleshoot, document technical systems, and communicate with stakeholders through pilot and rollout phases.