ICAM Privileged Access Management (PAM) Engineer

Description

The company needs a Privileged Access Management (PAM) engineer to design, implement and maintain privileged access capabilities that support the DoD ICAM mission.

You will handle secure credentials, govern the lifecycle of privileged accounts, monitor sessions and apply Zero Trust-aligned access protections across distributed, mission-critical environments.

Most of the work is CyberArk PAM engineering, along with the newer Xage platform used to secure privileged access in operational and distributed systems.

The ideal candidate is a hands-on PAM engineer with deep CyberArk integration experience who automates credential workflows, onboards privileged accounts and supports secure access to sensitive systems. Experience with Xage or similar distributed mesh security architectures is a strong plus.

Your work protects high-value assets, lowers insider and external risk, supports audit readiness and helps bring Zero Trust principles to enterprise and mission-partner environments.

This is an onsite position. The likely salary range is $140,250 - $189,750, but this is not a guarantee. Pay will depend on experience, geographic location and possibly contract requirements, and may fall outside this range.

Responsibilities

• Engineer, deploy, configure and maintain CyberArk components, including Vault, CPM, PSM, PVWA, PTA and credential onboarding workflows.
• Connect PAM controls to Active Directory, LDAP, Windows and Linux servers, cloud platforms, databases, network devices and mission applications.
• Implement and support Xage mesh security for distributed privileged access and operational technology (OT) environments.
• Build and maintain onboarding processes for privileged accounts, credential rotation policies, access control rules and session monitoring settings.
• Set up and maintain privileged session recording, auditing and behavioral analytics that flag anomalous access.
• Work with cybersecurity, ICAM and operations teams to set PAM governance standards, access policies and Zero Trust access controls.
• Build automation in PowerShell, Python or through APIs to speed up onboarding, provisioning and compliance reporting.
• Carry out root cause analysis, troubleshooting and incident response for PAM issues.
• Write and keep up architecture diagrams, SOPs, onboarding guides, security procedures and integration patterns.
• Make sure privileged access logs, reports and system configurations meet compliance standards for audits.
• Recommend improvements to datasets, transformations and visualization techniques.

Requirements

• Active Secret clearance at minimum. Interim Secret clearances are not accepted.
• Bachelor's degree in a related technical field and 8 years of experience, or an equivalent mix of education, technical certifications, training or work experience.
• DoD 8140 certification, Security+ CE or higher.
• Strong CyberArk engineering experience with Vault, CPM, PSM, PVWA and PTA.
• Experience managing the privileged user lifecycle, credential rotation and session recording.
• Ability to design PAM integrations across Windows, Linux, network devices, cloud platforms and databases.
• Understanding of authentication, authorization, MFA, Zero Trust and secure access governance.
• Experience troubleshooting PAM failures, onboarding problems, connectivity or agent issues and session recording gaps.
• Hands-on scripting in PowerShell or Python.
• Ability to document engineering procedures, architectures and integration steps clearly.
• Nice to have: experience with Xage Security Mesh, distributed access control systems or OT cybersecurity.
• Nice to have: experience implementing PAM in complex DoD, regulated or multi-tier security environments.
• Nice to have: familiarity with high-availability CyberArk architectures, DR and backup strategies and load-balanced deployments.
• Nice to have: experience supporting audits, compliance reporting and privileged access forensics.
• Nice to have: knowledge of DevOps pipelines, APIs, automation frameworks and CI/CD integrations for PAM workflows.
• Certifications: CompTIA Security+ CE.
• US citizenship required.

Conditions

Onsite in Fort Meade, Maryland, USA.

Standard scheduled hours are 40 per week.

Travel is less than 10% of the time.

Identity verification uses biometrics and AI. Virtual interviews require you to be on camera, and you consent to biometric processing for verification.

Equal opportunity employer, including individuals with disabilities and protected veterans.

Benefits

• Medical plan options, some with Health Savings Accounts, plus dental and vision plans.
• 401(k) with pre- and post-tax contributions up to IRS limits and a company match.
• Full flex work weeks where possible and paid time off for vacation, sick and personal days, holidays, parental, military, bereavement and jury duty.
• Short and long-term disability, life, accidental death and dismemberment, personal accident, critical illness and business travel accident insurance, provided or available.
• An AI-powered career tool that suggests career steps and learning, plus an internal mobility team.
• Competitive pay and a military-friendly workplace.