Privlege Access Management (PAM) Assistant Manager (T1) Technology & Digital Services –, Deloitte Support Services India Private Limited

Certifications mandatory

Organisation Summary

At Deloitte, we’re all about collaboration. And nowhere is this more apparent than among our 2,000-solid internal services team. With our combined specialist skills, we provide all the essential support and advice our client-facing colleagues need, right across the firm. This enables them to focus all their efforts on delivering the best service possible to their clients. Covering seven distinct areas; Human Resources, Clients & Industries, Finance & Legal, Practice Support Services, Quality & Risk Services, IT Services, and Workplace Services & Real Estate, together we live, breathe and deliver the Deloitte experience.

Team Summary

In the CISO team we are results focused and believe in excellence in respect in all aspects of our work and interaction with each other. We make full use of technologies that help support different ways of working. At Deloitte we believe the best impact is the value we add, not the hours we sit at our desk.

We, therefore, carefully consider agile ways of working, both formal and informal, that allow for the best impact for our people and our clients. If you would like to hear more about our flexible working arrangements, please let us know.

Location: Hyderabad

Work shift Timings:

- 9-hour shifts. Shift times will vary in accordance with business needs.
- Shifts (India time): 01:00 PM to 10:00 PM/ 2:00 PM – 11:00 PM (IST) (Hybrid)
- The team members should be willing to work in a rotating shift.
- Working on USI holidays and oncall during weekends when there is a business requirement.

Role description The privilege access management (PAM) consultant will be responsible for working with the PAM Manager/Assistant Manager to maintain Deloitte UK’s PAM solutions in accordance with the firm’s IAM policies and standards

Specific Responsibilities

- Perform daily system health check to identify and remediate any issues reported
- Manage privileged accounts in the PAM Tool as per PAM policies i.e. onboarding and offboarding users and accounts, managing password objects and their compliance
- Experience on password upload utility for bulk onboarding of privileged accounts
- Perform ticket management, manage ServiceNow queue, act as first point-of-contact for the client (service leads and/or end users), and conduct issue resolution sessions
- Comply to the defined SLAs/OLAs for the ServiceNow tickets.
- Create and update documents like SOPs,



runbooks, playbooks, end user guides, etc
- Support application patching for components and OS patching for vault following change management process
- Support out-of-office hours for critical and high priority issues, and any change management of PAM service.
- Facilitating meetings, taking minutes and circulating promptly and tracking actions.
- Co-ordinating with vendor for the open cases and product related issues

Qualifications

Required:

- Degree in IT / computer science or information security
- Experience in IT security Operation role or similar
- Minimum 2 years of experience supporting privileged access management solutions (CyberArk/ Thycotic)
- Basic industry certifications desirable e.g. Security+, COMP TIA etc
- Good to have at least one PAM tool specific certification (e.g. CyberArk, Thycotic, BeyondTrust, etc.
- Develop automation and/or scripting to augment PAM solutions as required
- Highly self-directed, with keen attention to details
- Strong communication, project and time management skills
- Ability to effectively prioritise tasks in a high-pressure environment
- Flexible and adaptable in regard to learning and understanding new technologies

Preferred

- Experience of using PowerShell would be an advantage.
- LDAP query, SQL scripting will be an added advantage
- Experience working on CyberArk or any other identity security platform.
- Assist in the development of detailed design documentation and deployment and operational support. Identify specific issues with migration or other directory technologies and have a basic understanding of how they interface
- Ability to communicate technical information to less experienced or non-specialist people, both verbally and in writing

Preferred Certifications (not a pre-requisite for the role):

- Defender (CyberArk)
- Sentry
- ITIL Foundation, ITIL Service Operations
- Azure fundamentals and Administration
- Cloud Security fundamentals
- CISMP, COMPTIA S+

Architecture & Infra Knowledge :- Look for specific environment sizing (e.g., "Managed 10,000+ endpoints and 5+ PVWA instances"). Lab-only profiles usually mention just 1 or 2 accounts.



The profile should explicitly mention setting up or managing Distributed Vaults, Cluster Vaults (using Quorum disks), and Disaster Recovery (DR) drills.Check for an understanding of the CyberArk Vault’s internal security (e.g., Code-Data Isolation, firewall rules, and specific port configurations like 1858 for Vault communication)

Advanced Component Engineering:-
CPM & PSM Customization: Look for experience creating custom connection components or modifying Process and Prompts files for non-standard target systems.Session Management: Experience with both PSM for Windows and PSM for SSH (PSMP), including session recording storage mechanics.Secrets Management (AAM/AIM): For senior profiles, look for Application Access Manager (AAM) or Conjur experience, proving they can handle machine-to-machine secrets integration for DevOps pipelines.EPM & PTA: Mention of Endpoint Privilege Manager (EPM) and Privileged Threat Analytics (PTA) indicates a comprehensive understanding of the complete CyberArk product suite.

Deep Troubleshooting & Maintenance Capability:-
Cred-File Recreation: A classic interview checkpoint. The profile or candidate must demonstrate how to resolve out-of-sync component users (like PVWAApp or CPM users) by recreating credentials files using the CreateCredFile utility.Reconciliation & Rotation Failures: Experience diagnosing CPM errors, managing Reconcile/Logon accounts, and fixing permission blocks on the target machine.Upgrades & Patching: Active participation in CyberArk version upgrades

Directory Integration & Ecosystem Automation:-
Directory Services: Robust experience with Active Directory (AD), LDAP/S integration, and configuring directory mapping for user provisioning.Authentication Policies: Implementing Multi-Factor Authentication (MFA), SAML integration, and Single Sign-On (SSO) for the PVWA portal.Automation & Scripting: Using REST APIs or CyberArk’s PACLI (Privileged Account CLI) alongside PowerShell or Python to automate bulk account onboarding and continuous monitoring

apart from the technical requirements, soft skills, communication, executive presence is important

Upgrades, custom CPM/PSM plug-in development, Cluster Vaulting, AAM/Conjur pipeline integrations

The privilege access management (PAM) consultant will be responsible for working with the PAM Manager/Assistant Manager to maintain Deloitte UK’s PAM solutions in accordance with the firm’s IAM policies and standards

overall exp at AM level - upto 8 years and relevant exp in CyberArk (any PAM solution) is upto 4 years

📌 CyberArk with Thycotic or BeyondTrust and PAM Platform (Hyderabad)
🏢 Cloudxtreme
📍 Hyderabad