Senior CyberArk Operations Engineer

Job description

At Bristol Myers Squibb, our employees often ask, “Who are you working for?”—a question that fuels collaboration, accountability, and urgency in our work. Our purpose-driven culture inspires us to discover, develop, and deliver innovative medicines to prevail over serious diseases. We offer uniquely interesting and meaningful work, opportunities for growth, and a supportive environment that values inclusion, wellbeing, flexibility, and comprehensive benefits. This is work that transforms the lives of patients, and the careers of those who do it. Overview: We are seeking an experienced Senior CyberArk Operations Engineer to take ownership of our CyberArk privileged access management infrastructure and the integrations that support password management and retrieval across the enterprise. Our privileged access estate is moving to the CyberArk SaaS model, and the successful candidate must bring hands-on experience of operating CyberArk in a SaaS deployment together with a working understanding of the migration path from self-hosted to SaaS — whether to complete remaining migration waves or to stabilise, optimise, and run the platform once the transition is complete. The role also holds design and delivery ownership for the introduction of secrets management for application and DevOps teams and the redesign of the PMUL and ADB scope and control model. Beyond day-to-day responsibility for platform health, upgrades, and third-party integration, the successful candidate will act as the accountable owner for privileged access control decisions, progressively convert routine operational work into automation and self-service, and build PAM capability across the wider team. Responsibilities: Own the installation, configuration, and maintenance of CyberArk vault server infrastructure, ensuring compatibility and seamless integration with third-party systems for password management and retrieval. Own the operation and optimisation of the CyberArk SaaS environment — tenant and connector architecture, connector capacity and resilience, integration health, vendor release and feature adoption, and validation that privileged access controls operate as designed in the SaaS model. Lead any remaining migration or onboarding waves to the SaaS platform, including integration re-establishment, cutover sequencing, rollback planning, and post-migration control validation, and drive the decommissioning and clean-up of legacy self-hosted components. Design and deliver the introduction of secrets management for application and DevOps teams, including the onboarding pattern, integration of secrets retrieval into build and deployment pipelines, and the retirement of hardcoded and embedded credentials. Define the target scope and control model for PMUL and ADB and own the operational transition to it. Collaborate with cross-functional teams to identify integration requirements and design solutions that meet business needs while adhering to security and operational standards. Configure and maintain integrations between CyberArk and other password management products, such as Active Directory, LDAP, SSO solutions, and cloud-based identity providers. Monitor the health and performance of integrated systems, troubleshooting issues and optimizing configurations to ensure smooth operation, and act as the final escalation point for complex CyberArk and BeyondTrust faults. Develop custom scripts, automation workflows, and API-based integrations to streamline password management processes and enhance system interoperability, with a standing mandate to reduce recurring privileged access ticket volume through self-service and automation. Plan and execute software upgrades, patches, and maintenance activities for CyberArk and integrated systems, including impact assessment and control validation, ensuring minimal disruption to operations. Act as the accountable owner for privileged access control decisions — approval judgement on elevated and non-standard requests, break-glass authorisation, exception handling, and the technical response to internal and external audit. Own the platform, safe, policy, and permission model for the privileged access estate and approve changes to it. Support and enhance endpoint privilege management and just-in-time administrator access through BeyondTrust, including policy design and troubleshooting across Windows, Linux, and macOS. Collaborate with IT Security teams to implement and enforce security policies and best practices for password management across integrated systems. Provide technical support, direction, and review to end-users, IT teams, and operations engineers on privileged access processes and integrations. Develop and maintain documentation, runbooks, and standards, and deliver structured cross-training so that privileged access coverage is held by multiple engineers rather than a single individual. Stay informed about industry trends and emerging technologies in password management and privileged access management, proactively identifying opportunities for integration improvement and optimization. Qualifications: Bachelor's degree in Computer Science, Information Technology, or related field (or equivalent work experience). 5 or more years of experience working with CyberArk privileged access management solutions, including at least 3 years in a design or engineering capacity rather than administration alone, with a focus on integrations with other password management products. Hands-on experience operating CyberArk in a SaaS deployment (Privilege Cloud or equivalent), including tenant and connector administration, integration management, and adoption of vendor-driven releases. Direct involvement in a migration from self-hosted CyberArk to the SaaS model — or an equivalent major version or architecture migration — with a clear working understanding of the migration approach, cutover and rollback planning, integration re-establishment, and post-migration control validation. Strong working knowledge of CyberArk components such as EPV, CPM, PSM, PVWA, PTA, and CCP/AAM, including installation, configuration, troubleshooting, and high availability and disaster recovery design. Experience integrating CyberArk with other products for password management and retrieval, such as Active Directory, LDAP, SSO solutions, and cloud-based identity providers. Strong scripting skills in languages such as PowerShell or Python, with hands-on use of CyberArk REST APIs to develop custom scripts, automation workflows, and self-service capability. Excellent analytical and problem-solving skills, with the ability to troubleshoot complex technical issues related to integrations and interoperability. Effective communication skills, both written and verbal, with the ability to collaborate with technical and non-technical stakeholders to understand requirements and deliver solutions, and to present design decisions and control rationale to security leadership and audit. CyberArk Certified Defender (CCD) required; CyberArk Sentry or Guardian, or equivalent senior privileged access certification, strongly preferred. Ability to work independently with minimal direction, with a strong sense of ownership and accountability, and the capability to mentor and cross-train other engineers. Willingness to learn and adapt to new technologies and methodologies in the field of privileged access management and password management integrations. Additional Skills for Upcoming Initiatives: Experience running a hybrid privileged access estate during and after a SaaS transition, including coexistence of self-hosted and SaaS components and legacy decommissioning. Practical experience with secrets management platforms such as CyberArk Conjur, HashiCorp Vault, or a cloud-native equivalent, and with removing hardcoded credentials from application code and CI/CD pipelines. Familiarity with DevOps tooling and pipeline integration (Jenkins, GitLab, Azure DevOps, Ansibl