Position: Python Automation Engineer
Location: Phoenix, AZ (Hybrid 3 days in office)
PAM Engineer Job Description Breakdown & Recruiter Guide
The short version
This is a Python automation engineer who works in privileged access management (PAM), not a pure CyberArk administrator.
Companies have powerful accounts (admin logins, database credentials, service accounts) that could give an attacker access to everything if stolen. PAM locks those accounts in a secure vault, controls who can use them, records what they do, and rotates the passwords automatically. This person keeps that system running and writes code so it runs with less manual effort.
Who this person is, in one sentence: a security-minded software or systems engineer who understands identity and access, writes solid Python, and can run their own projects, ideally with some CyberArk experience.
What they'd do day to day
The job splits into four kinds of work:
- Operate the PAM environment: onboard accounts into the vault, fix things that break, handle access requests, and keep the system healthy.
- Automate: write Python (plus PowerShell or Bash) scripts and integrations so tasks once done by hand happen automatically.
- Run projects independently: take an assignment from kickoff to delivery without much hand-holding.
- Integrate systems: connect the PAM tool to identity platforms such as Okta or Microsoft Entra ID through APIs.
CyberArk is the product this client uses; the rest of the terms below are its parts or the systems it connects to.
Term | What it means |
CyberArk | The leading PAM software product. This is the tool the client uses. |
Digital Vault | The secure "safe" where privileged passwords and secrets are stored. |
CPM (Central Policy Manager) | Automatically changes and verifies passwords on a schedule. |
PSM (Privileged Session Manager) | Proxies and records admin sessions, creating an audit trail. |
PVWA (Password Vault Web Access) | The web interface people use to request and retrieve access. |
Okta / Entra ID / Auth0 | Identity platforms that handle login and single sign-on. |
REST API | The standard way software systems talk to each other, and how most of the automation gets built. |
AD / LDAP | Directory systems that store users and groups. |
AI / ML / LLM familiarity | Using AI to spot unusual privileged activity or analyze logs. A "nice to understand" item, not the core of the job. |
How to read the requirements
Programming ability and independent delivery are the real core; CyberArk is a bonus, and the long bullet list is a wish list that almost no one fully matches.
- Programming is the core. Python is the first bullet, and the posting repeats "independent" and "end-to-end" several times. They want a builder who owns outcomes, not only an administrator.
- CyberArk is "preferred, not mandatory." A strong Python and identity/security engineer who can learn CyberArk is acceptable. This is the biggest lever for widening the candidate pool.
- Treat most of the list as bonuses. Screen hard on the must-haves below and weigh the rest as differentiators.
Must-haves (screen hard)
- Production Python, with design, debugging, and maintenance owned independently
- Independent end-to-end project delivery
- REST API design, integration, and security
- IAM and privileged access fundamentals, plus AD/LDAP and authentication protocols (Kerberos, SAML, OIDC)
- Git, plus PowerShell or Bash scripting
Strong differentiators
- Hands-on CyberArk experience (PVWA, CPM, PSM, Digital Vault), especially the CyberArk REST API and CPM plugin or PSM connector development
- Okta, Entra ID, or Auth0 integration experience
- Applied AI/LLM work in security operations, such as log analysis, anomaly detection, or risk scoring
