We are looking for an experienced CyberArk PAS and Endpoint Privilege Manager (EPM) Engineer to support the implementation, administration, maintenance, and enhancement of CyberArk Privileged Access Management and Endpoint Privilege Management solutions.

The candidate should have 8-10 years of hands-on experience managing privileged accounts, CyberArk infrastructure components, password rotation, privileged session management, application onboarding, endpoint privilege policies, troubleshooting, upgrades, integrations, and operational support.

Key Responsibilities – CyberArk PAS

- Administer and support the CyberArk Privileged Access Security environment.
- Manage CyberArk components including:
- Digital Vault
- Password Vault Web Access (PVWA)
- Central Policy Manager (CPM)
- Privileged Session Manager (PSM)
- PSM for SSH
- Credential Provider / Central Credential Provider, where applicable
- Onboard privileged accounts into CyberArk for different types of systems like Windows, Linux/Unix server, databases, network devices, applications etc
- Configure and maintain CyberArk Safes, platforms, account permissions, and access controls.
- Configure automated password rotation, verification, reconciliation, and password-management policies.
- Troubleshoot CPM password-change, verification, and reconciliation failures.
- Troubleshoot PSM connectivity and privileged-session issues.
- Configure and maintain PSM connection components.
- Manage account discovery and onboarding processes.
- Perform bulk onboarding and privileged-account remediation activities.
- Support onboarding of Windows service accounts, scheduled tasks, IIS application pools, and other dependent accounts.
- Configure dual-control, approval workflows, access restrictions, and session monitoring where required.
- Perform CyberArk health checks and proactively identify service availability or performance issues.
- Support CyberArk disaster recovery and high-availability configurations.
- Support CyberArk upgrades, patches, platform updates, and component migrations.
- Support integration with cloud environments such as Microsoft Azure and AWS where applicable.
- Develop or customize CyberArk platforms and connection components based on business requirements.
- Manage privileged account lifecycle activities including onboarding, modification, rotation, suspension, and decommissioning.
- Investigate failed password rotations, locked accounts, authentication issues, and privileged-session failures.

Key Responsibilities – CyberArk EPM
- Administer and support the CyberArk Endpoint Privilege Manager platform.
- Manage EPM policies for Windows and/or macOS endpoints.
- Implement the principle of least privilege on corporate endpoints.




- Develop and maintain policies for application elevation, privilege removal application control, trusted/blocked applications, Just-in-Time administrative access and Local administrator privilege management
- Analyze endpoint application events and identify applications requiring elevation or control.
- Design controlled privilege-elevation policies while minimizing user disruption.
- Review EPM events and identify unauthorized, suspicious, or high-risk application activity.
- Troubleshoot EPM agent installation, communication, policy, and application elevation issues.
- Support EPM agent deployments and upgrades.
- Monitor endpoint-agent health and policy synchronization.
- Assist with EPM policy optimization to reduce unnecessary prompts and false positives.
- Support implementation of application allowlisting and blocklisting controls.
- Support emergency or temporary privilege-elevation requirements.
- Maintain EPM policy documentation, standards, and exception records.
- Generate EPM operational and compliance reports.

Security & Compliance Responsibilities
- Ensure privileged accounts comply with enterprise password-management and access-control standards.
- Assist with periodic privileged-access reviews and recertification.
- Support internal and external audit requests.
- Support audit requirements and provide requested evidence to the auditors.
- Ensure CyberArk configurations align with least-privilege and zero-trust principles.
- Support remediation of privileged-access security findings.
- Identify security risks associated with excessive endpoint administrative privileges.
- Assist with privileged-access policy and standards implementation.

Required Technical Skills The candidate should have hands-on experience with most of the following:

CyberArk PAS

- Strong hands-on experience with Vault, PVWA, CPM, PSM and PSM for SSH
- Strong understanding of designing and managing CyberArk Safes
- Experience with onboarding network devices, databases
- Experiencing working on CyberArk SaaS module
- Password rotation/reconciliation
- Privileged session management

CyberArk EPM
- Design, configure, and manage CyberArk EPM policies, including application control, application groups, and policy-based privilege management.
- Implement and troubleshoot application elevation and JIT privilege elevation,



ensuring applications receive elevated privileges only when required and for the appropriate duration.
- Implement least-privilege controls, including removal and management of local administrator privileges while ensuring business applications continue to function as required.
- Plan and perform CyberArk EPM agent deployment, configuration, and troubleshooting across endpoints, including resolving agent-related issues.
- Analyze EPM events and application activity to identify privilege-related risks, investigate application behavior, and determine appropriate policy or controls.

Operating Systems
- Operating Systems - Good working knowledge of Windows Server, Linux/Unix. Knowledge of Mac devices will be an added advantage
- Networking - Working knowledge of TCP/IP, DNS, firewalls, proxy, load balancers, SSH, RDP, etc.
- Basic working knowledge of privileged-access management for technologies such as Microsoft SQL Server, Oracle, MySQL, PostgreSQL, Application/service accounts
- Cloud Knowledge - Exposure to privileged-access management within cloud environments is preferred, including Microsoft Azure and AWS

Required Experience
- 8–10 years of overall experience in CyberArk/PAM technologies.
- Minimum 5 years of hands-on CyberArk PAS administration or engineering experience.
- Practical experience supporting CyberArk EPM environments.
- Experience onboarding privileged accounts across Windows, Linux, database, network, and application environments.
- Experience troubleshooting CPM, PVWA, PSM, Vault, and EPM-related issues.
- Experience working in enterprise production environments.
- Experience implementing least-privilege and privileged-access security controls.
- Experience participating in CyberArk change, upgrade, migration, or enhancement activities.
- Experience with migration to CyberArk SaaS platform is preferred
- Good knowledge of ITIL practices and experience with ServiceNow

Certifications – Preferred One or more of the following would be beneficial:
- CyberArk Certified Defender
- CyberArk Certified Sentry
- CyberArk Certified Guardian
- CyberArk EPM-related certification/training

Certifications are desirable but should not replace relevant hands-on CyberArk experience.

Soft Skills

- Strong troubleshooting and analytical skills.
- Positive written and verbal communication skills.
- Ability to work with Infrastructure, Application, Security, IAM, and Cloud teams.
- Ability to manage multiple incidents and requests simultaneously.
- Ability to document technical solutions and operational procedures.
- Strong ownership of assigned incidents and technical issues.

Ability to work independently as well as within a global security team.

📌 Security Consultant (Maharashtra)
🏢 Tech Mahindra
📍 Maharashtra