CyberArk Engineer – OT Security

Job Title: CyberArk Engineer – OT Security
Onsite

Job Summary

We are seeking an experienced CyberArk Engineer to implement, configure, and support Privileged Access Management (PAM) and Secrets Management solutions within Operational Technology (OT) environments. The ideal candidate will have hands-on experience with CyberArk PAM, Vault administration, CyberArk Secrets Manager, and securing privileged access to industrial systems, including SCADA, DCS, PLC, and other OT infrastructure.

Key Responsibilities

• Deploy, configure, and administer CyberArk PAM solutions, including Digital Vault, PVWA, CPM, and PSM.
• Implement and support CyberArk Secrets Manager for secure storage, retrieval, and rotation of application credentials, API keys, and service account secrets.
• Integrate CyberArk with OT assets, including SCADA systems, Distributed Control Systems (DCS), PLC environments, industrial servers, and engineering workstations.
• Manage privileged accounts, Safes, access policies, credential onboarding, and automated password rotation.
• Configure Role-Based Access Control (RBAC), least-privilege access, and secure remote access for OT engineers, administrators, vendors, and third-party service providers.
• Support integration with Active Directory, LDAP, SIEM platforms, and enterprise identity management systems.
• Configure and troubleshoot TLS certificates, secure communications, high availability (HA), and disaster recovery (DR).
• Support secure access to OT systems while maintaining operational availability and minimizing disruption to critical industrial processes.
• Collaborate with OT security, infrastructure, networking, and cybersecurity teams to implement security controls aligned with IEC 62443 and relevant organizational policies.
• Troubleshoot access issues, secret retrieval failures, credential rotation errors, and CyberArk platform performance issues.
• Maintain technical documentation, implementation procedures, audit evidence, and operational support runbooks.

Required Qualifications

• 5+ years of experience in cybersecurity, privileged access management, or identity security.
• Strong hands-on experience implementing and administering CyberArk PAM.
• Experience with CyberArk Digital Vault, PVWA, CPM, PSM, Safes, and privileged account lifecycle management.
• Hands-on experience deploying, configuring, and integrating CyberArk Secrets Manager, preferably Conjur.
• Strong knowledge of RBAC, credential rotation, secrets management, API integrations, TLS certificates, HA, and DR.
• Experience integrating CyberArk with Windows/Linux systems, service accounts, applications, and enterprise infrastructure.
• Understanding of OT environments, including SCADA, DCS, PLCs, industrial networks, and engineering workstations.
• Knowledge of OT cybersecurity principles, network segmentation, least-privilege access, and IEC 62443 standards.
• Strong troubleshooting, documentation, and stakeholder communication skills.

Preferred Qualifications

• Experience implementing CyberArk in manufacturing, utilities, energy, oil and gas, or other industrial environments.
• Exposure to OT remote access security and third-party vendor access management.
• Experience with SIEM integration, PowerShell/Python scripting, REST APIs, and automation.
• Relevant CyberArk certifications or OT cybersecurity certifications are an advantage.

Key Requirement: Candidates must demonstrate hands-on CyberArk implementation and integration experience, preferably in OT/industrial environments. General CyberArk administration experience without Secrets Manager expertise may not be sufficient.