Senior Security Engineer Windows, AD and PAM

This role focuses on strengthening the security and management of Active Directory and certificate services within the organization. The successful candidate will be responsible for securing privileged accounts by integrating them into CyberArk and validating all changes through thorough re-testing. The position requires a proactive approach to identifying vulnerabilities, implementing best practices, and ensuring compliance with security standards.

Key Responsibilities

- Harden Active Directory by cleaning up Tier-0 and privileged groups, refining delegation, and managing administrative tiers effectively.
- Transition service accounts to Group Managed Service Accounts (gMSA), deploy Windows Local Administrator Password Solution (LAPS), and eliminate exposed credentials from file shares.
- Perform critical security tasks such as rotating the krbtgt account, enhancing Kerberos encryption, enforcing LDAP signing, and remediating vulnerable Active Directory Certificate Services (ADCS) templates.
- Discover and reconcile privileged accounts, onboard them into CyberArk, and manage credential rotation processes.
- Segregate CyberArk safes, establish approval workflows, and configure Privileged Session Manager (PSM) session controls to ensure secure access management.
- Develop and maintain PowerShell scripts to automate identity lifecycle management, including handling account expiry, duplicates, and leavers.
- Assess dependencies before making changes such as credential rotation, protocol updates, or account removals, and document procedures by creating comprehensive runbooks.

Required Qualifications

- Bachelor’s degree in Information Technology, Computer Science, or a related discipline.
- A minimum of 3 to 5 years of hands-on experience working in production environments with Active Directory, ADCS, Group Policy, and hybrid identity solutions.
- At least 3 years of practical experience implementing CyberArk Privileged Access Management components, including Vault, Central Policy Manager (CPM), Password Vault Web Access (PVWA), and Privileged Session Manager (PSM).
- Strong proficiency in PowerShell scripting for automation and management tasks.

This position demands a detail-oriented professional with a strong technical background in identity and access management, particularly within Microsoft environments. The role offers an opportunity to significantly enhance the organization’s security posture by applying advanced security controls and automation techniques.