IAM Production Cybersecurity Architect - CyberArk

Role Overview

The APAC IAM Production Cybersecurity Architect specializing in CyberArk leads the design, deployment, and continuous enhancement of CyberArk vault and other privileged access management solutions throughout the APAC region. Reporting directly to the APAC Head of IAM Production, this position is entrusted with the responsibility of securing and monitoring all privileged credentials and sessions to mitigate threats such as credential theft, insider misuse, and unauthorized lateral movement within the organization.

Key Performance Metrics

• Possession of expert-level knowledge in CyberArk components like Vault, PSM, CPM alongside PAM solutions.
• Advanced L3 expertise in Conjur including policy-as-code, secret lifecycle automation, and Kubernetes integration, complemented by extensive hands-on experience with CyberArk’s privileged access management.
• Proven success in constructing high-availability, fault-tolerant identity platforms that feature thorough monitoring, automated issue resolution, and formal disaster recovery protocols.
• Strong dedication to client and stakeholder engagement along with strict compliance culture adherence.

Primary Responsibilities

• Develop and maintain enterprise-wide CyberArk architecture (Vault, CPM, PSM, PVWA, Conjur) to manage the bank’s technical accounts inventory efficiently.
• Establish and enforce privileged access policies such as least privilege, segregation of duties, and time-limited access across diverse systems including Windows, Linux, UNIX, database platforms, and major cloud providers (AWS, Azure, GCP).
• Ensure 24×7 availability of CyberArk services through robust monitoring, incident management, and disaster recovery processes.
• Oversee the secret management lifecycle incorporating automated password rotations, SSH key handling, secure API credential storage, and on-demand retrieval processes.
• Collaborate with engineering, application, and cloud teams to integrate secure identity controls into service launches, migrations, and platform updates.
• Automate privileged access management workflows with scripting languages such as PowerShell and Python and CyberArk REST APIs, enabling bulk operations and scheduled credential rotations.
• Research emerging PAM technologies including CyberArk Conjur, Secret-Zero, and Zero-Trust Privilege, proposing business cases for their adoption as appropriate.
• Work closely with DevSecOps, cloud, and application teams to embed privileged access controls within CI/CD pipelines and cloud-native workloads.

Technical Qualifications

• A minimum of 8 years’ experience in security-related roles.
• Bachelor’s degree in Computer Science, Information Security or related discipline; a Master’s degree is preferred.
• Expertise in designing, deploying, and managing CyberArk PAS components (Vault, CPM, PSM, PVWA) at enterprise scale.
• Advanced L3 familiarity with CyberArk Conjur — policy-as-code (CPL/HCL), secret rotation, dynamic secret generation, Kubernetes side-car injection, and API/CLI integrations.
• In-depth knowledge of core CyberArk PAS technologies including Privileged Threat Analytics.
• Strong understanding of Windows, Linux, UNIX authentication mechanisms, Kerberos, LDAP/AD integration, SSH, and database authentication.
• Experience in integrating CyberArk with SSO/Identity Provider systems (SAML, OIDC, Active Directory).
• Proficiency in automation using PowerShell, Python, and CyberArk REST APIs.
• Awareness of cloud secrets management services such as AWS Secrets Manager and Azure Key Vault, plus hybrid IAM environments.
• Comprehensive knowledge of Zero-Trust security principles for privileged access management.

Behavioral Competencies

• Excellent communication and interpersonal skills with strong influencing and motivational abilities.
• Use of PAM analytics including session recordings and anomaly scoring to support risk-driven decision making.
• Capability to maintain professionalism under pressure, effectively collaborating with business and technical stakeholders across the organization.

Certifications

• CyberArk Certified Defender (CCD)
• Certified Secrets Manager (Conjur)