L3 BeyondTrust Password Safe Engineer / PAM Specialist

Job Summary The L3 BeyondTrust Password Secure Engineer / PAM Specialist is responsible for the engineering, implementation, optimization, and advanced support of the enterprise BeyondTrust Privileged Access Management (PAM) platform.

This role serves as a senior technical escalation point and is expected to proactively identify PAM coverage and control gaps, assess associated privileged-access risks, and drive technical remediation to closure. The engineer will work across security, infrastructure, cloud, application, and identity teams to improve PAM coverage and reduce privileged-access risk across the enterprise.

Key Responsibilities

PAM Engineering &

- Administration
- Design, configure, maintain, and optimize BeyondTrust Password Safe.
- Configure Managed Systems, Managed Accounts, Smart Rules, Access Policies, password rotation, discovery, and privileged session management.
- Support highly available and resilient Password Safe environments.
- Evaluate and implement platform improvements and new capabilities.

Discovery, Gap Assessment &

- Risk Remediation
- Proactively discover privileged accounts, systems, service accounts, and other privileged identities across the enterprise.
- Identify unmanaged privileged accounts, PAM coverage gaps, control weaknesses, and configuration risks.
- Assess and prioritize identified gaps based on security risk and business impact.
- Develop and execute remediation plans to reduce privileged-access risk.
- Drive identified PAM gaps through remediation and validate successful closure.
- Identify accounts or access paths bypassing PAM controls and recommend appropriate remediation or compensating controls.
- Track and improve PAM coverage, including discovered vs. managed privileged accounts and systems.

Account &

- System Onboarding
- Onboard privileged accounts and systems including Windows, Linux, databases, applications, network devices, cloud platforms, service accounts, and functional accounts.
- Troubleshoot complex onboarding issues and technical dependencies.




- Design appropriate password-management and rotation strategies for service and application accounts.
- Identify opportunities to streamline and automate onboarding.

Advanced Troubleshooting &

- L3 Support
- Serve as the technical escalation point for complex BeyondTrust issues.
- Troubleshoot:

o Password rotation and reconciliation failures o Discovery and Smart Rule issues o Authentication and authorization failures o Session-management and recording issues o API and integration failures o Platform performance, HA, and infrastructure issues

- Perform Root Cause Analysis (RCA) and implement permanent corrective actions.
- Work with BeyondTrust Support on product-level issues when required.

Integrations &

- Automation
- Integrate BeyondTrust Password Safe with Active Directory, Entra ID, LDAP, MFA, ServiceNow, SIEM platforms, databases, and cloud environments.
- Develop automation using PowerShell, Python, and BeyondTrust REST APIs.
- Automate account/system onboarding, discovery, policy assignment, reporting, and other repetitive PAM activities.
- Troubleshoot integrations end-to-end across BeyondTrust and dependent infrastructure.

Platform Upgrades &

- Resilience
- Plan and execute Password Safe upgrades, patches, and migrations.
- Perform compatibility and dependency assessments.
- Develop implementation, validation, rollback, backup, and recovery plans.
- Support and validate platform HA/DR capabilities.

Security, Risk &

- Compliance
- Implement PAM controls aligned with least privilege, Zero Trust, NIST, CIS, SOX, and internal security requirements.
- Support security assessments, audits, and PAM control testing.
- Identify privileged-access risks and drive technical remediation.
- Support management of PAM exceptions and compensating controls.

Documentation &

- Knowledge Transfer




- Maintain architecture diagrams, technical documentation, SOPs, troubleshooting guides, and operational/DR runbooks.
- Provide knowledge transfer and technical guidance to L1/L2 engineers.
- Contribute technical recommendations to the PAM roadmap and continuous improvement initiatives.

Required Technical Skills

BeyondTrust Password Safe

Strong hands-on experience with:

- Managed Systems and Managed Accounts
- Account/System Discovery
- Smart Rules
- Access Policies
- Password Rotation and Reconciliation
- Privileged Session Management and Recording
- Application and System Onboarding
- Service/Functional Account Management
- REST APIs
- Reporting and Auditing
- Platform troubleshooting and upgrades

Infrastructure &

- Identity

Strong working knowledge of

- Windows and Linux
- Active Directory and Microsoft Entra ID
- LDAP/LDAPS
- DNS and PKI/Certificates
- Microsoft SQL Server
- Authentication and network connectivity concepts
- AWS/Azure environments

Automation

- PowerShell and/or Python
- REST APIs
- Experience automating PAM onboarding and operational activities

Experience Requirements

- 7+ years of IT Security, Infrastructure, or IAM experience.
- 7+ years of PAM experience.
- 5+ years of recent hands-on BeyondTrust Password Safe engineering experience.
- Experience supporting enterprise-scale PAM environments.
- Demonstrated experience with privileged-account discovery, onboarding, troubleshooting, and risk remediation.

Preferred Certifications

- BeyondTrust certifications relevant to Password Protected
- Relevant IAM, security, Microsoft, or cloud certifications are advantageous.

Key Expectation

This is a hands-on PAM engineering role, not primarily a coordination or ticket-management position.

The successful candidate must be able to independently:

Discover privileged access → Identify gaps → Assess risk → Remediate → Validate closure The objective is to continuously improve BeyondTrust coverage, platform reliability, automation, and the organization’s overall privileged-access security posture.

📌 Software Engineer (Noida)
🏢 NXP Semiconductors
📍 Noida