Senior PAM Engineer - CyberArk

You will take ownership of a mature, production-critical CyberArk Privileged Access Management platform that protects privileged access across a financial-services group. This is a transfer, not a greenfield build: the self-hosted estate — Vault and DR Vault, CPM, PVWA, PSM, PSMP — has been run from our European engineering centre for years, and you will spend your first months working directly with the engineers who build and run it today before taking it over. If you want to inherit a well-documented platform with genuinely hard operational problems and a European team that hands over properly, this is that role.

Key Responsibilities:

• Keep the full CyberArk estate available, healthy and performant — Vault and DR Vault, CPM, PVWA, PSM and PSMP, across production and non-production.
• Plan and run component-by-component upgrades of a distributed CyberArk estate — test first, production after, with rollback thinking at every step.
• Troubleshoot the hard failures: broken connections and sessions, credential-rotation failures, certificate and client-side issues; raise and drive CyberArk support cases.
• Administer and harden the underlying Windows Server and Linux hosts — OS patching, AppLocker for PSM, GPO, and coexistence with endpoint-security tooling.
• Support engineer and administrator users and lead incident response during outages, with honest root-cause writeups; participate in an on-call rotation.
• Build and maintain custom platforms and PSM connectors for target systems, including web applications.
• Operate the web tier and load balancing — SSL/TLS certificate renewal and deployment, IIS, and HAProxy failover in front of the platform.
• Automate routine operations and reporting via PowerShell and the CyberArk REST API — account onboarding, health checks, usage and licence reports.
• Keep runbooks and upgrade and troubleshooting knowledge current in the team's SharePoint portal.

Your Experience and Skills

• Solid hands-on experience operating CyberArk Self-Hosted PAM (Core PAS) in production — Vault, CPM, PVWA, PSM. You have upgraded it, not only administered it.
• CyberArk Certified Sentry (PAM) — a hard requirement, as it is the prerequisite for the CDE certification the team works towards (fully funded and supported).
• Strong Windows Server and Active Directory administration — authentication, group policy, hardening, service accounts — plus working Linux administration for the components that run on it.
• Practical certificate and web-tier skills: HTTP/HTTPS, TLS, creating, renewing and troubleshooting certificates, and IIS administration.
• Load-balancing and failover experience (HAProxy or equivalent), and networking fundamentals to tell whether a problem is CyberArk, DNS, the load balancer, or a firewall rule.
• Scripting and automation with PowerShell, and comfort working with REST APIs.
• Methodical troubleshooting — the patience to isolate a problem rather than restarting services and hoping.
• Fluent English (C1 or equivalent), spoken and written, for daily contact with European colleagues and English technical documentation.
• Nice to have: PSM connector and custom platform development; regulated or financial-services experience; exposure to another PAM product such as Delinea or BeyondTrust.

Join EmbedIT family and enjoy

• 20+ years of engineering expertise delivering large-scale IT transformation and fintech solutions.
• Impact platforms used by 140M+ users across Europe and Asia.
• Join a 500+ global engineering community working across 8 time zones.
• Work in a truly international environment, collaborating with teams across Czech Republic and APAC.
• Hybrid and flexible working setup that supports work-life balance.
• Competitive compensation package including base salary, allowances, 13th-month salary, and performance bonuses.
• Premium healthcare insurance, 24/7 accident coverage, and annual health checkups.
• Extra perks including meal allowance, phone allowance, company laptop, and parking support.