Supporting a hybrid enterprise environment spanning Active Directory, Azure, and AWS, the Senior Privileged Access Management (PAM) Engineer - Team Lead leads privileged access management and TLS certificate lifecycle activities for Zelis IT systems. This is a hands-on technical leadership role, ideal for someone who thrives in dynamic environments and is passionate about Security, PAM, Automation, and Machine Identity Management, focusing on CyberArk Privilege Cloud and Venafi TLS certificate management.
Responsibilities
Manage and enhance privileged access lifecycle capabilities using CyberArk Privilege Cloud, including credential vaulting, session management, privileged session monitoring, and Just-in-Time (JIT) access
Design and implement PAM solutions aligned with organizational security standards, including least privilege enforcement, credential rotation, session isolation, and privileged access workflows across enterprise systems
Lead engineering initiatives to integrate PAM controls across infrastructure and applications, including Active Directory, Azure AD, AWS IAM, and cloud-native services
Develop and maintain machine identity management solutions using Venafi, including TLS certificate lifecycle management, automation of certificate issuance/renewal, and integration with enterprise platforms and DevOps pipelines
Architect and implement automation frameworks and accelerators to streamline PAM and certificate management processes, improving scalability, auditability, and operational efficiency
Analyze and troubleshoot PAM and certificate management system issues, conducting root cause analysis and implementing durable solutions to improve system reliability and security posture
Collaborate with infrastructure, security, DevOps, and application teams to onboard systems into CyberArk and Venafi, ensuring consistent enforcement of privileged access and certificate policies
Monitor PAM and machine identity platforms to ensure performance, availability, and compliance with organizational policies and SOPs
Lead response efforts for critical incidents involving privileged accounts or certificate outages
Provide technical leadership and mentorship to junior engineers, promoting best practices in PAM, automation, and secure design
Drive continuous improvement by researching emerging PAM and machine identity trends, including secrets management, workload identity, and cloud-native privilege models
Develop and maintain documentation including architecture diagrams, onboarding guides, SOPs, and knowledge base articles for PAM and certificate management operations
Requirements
Proven experience implementing and managing CyberArk Privilege Cloud in an enterprise environment, including vaulting, CPM, PSM, and session management
Hands-on experience with Venafi (or similar certificate lifecycle management platforms) for managing TLS/SSL certificates at scale
Millions of jobs, with real people getting hired every day
200,000+
New jobs added daily
7,000,000+
Verified job listings
1,000,000+
Tailored applications submitted
Strong understanding of PAM principles, including least privilege, credential management, session monitoring, JIT access, and privileged threat mitigation
Experience working in hybrid environments with Active Directory, Azure AD, and AWS IAM
Proficiency in scripting and automation (e.g., PowerShell, Python) and experience with automation platforms (e.g., Azure Automation, AWS Lambda, CI/CD pipelines)
Familiarity with authentication and authorization mechanisms, including Kerberos, LDAP, SAML, OAuth, OpenID Connect, and secrets/token-based authentication
Experience integrating PAM solutions with enterprise systems using REST APIs, secure authentication methods, and service accounts
Strong understanding of TLS/SSL, PKI concepts, certificate authorities, and cryptographic standards
Excellent communication and collaboration skills, with the ability to work across technical and business teams
Ability to lead technical initiatives and deliver results without direct managerial authority
Unable to proceed with candidates who require visa sponsorship now or in the future
Nice to have:
CyberArk certifications (e.g., CyberArk Defender, Sentry, or Guardian)
Experience with DevOps and secrets management tools (e.g., HashiCorp Vault, Kubernetes secrets, Azure Key Vault, AWS Secrets Manager)
Familiarity with compliance and regulatory frameworks (e.g., SOX, HIPAA, PCI-DSS, NIST)
Experience with cloud-native PAM capabilities (e.g., Azure Privileged Identity Management (PIM), AWS IAM Access Analyzer)
Knowledge of containerized and microservices environments and their impact on privileged access and certificate management
Benefits
Highly competitive benefits package
401k plan with employer match
Flexible paid time off
Holidays
Parental leaves
Life and disability insurance
Health benefits including medical, dental, vision, and prescription drug coverage
Important Details
Locations: Atlanta GA, Boston MA, Morristown NJ, Plano TX, St. Louis MO, St. Petersburg FL, and Hyderabad, India
Work format: hybrid and remote friendly culture, based on the needs of the position and determined by the Leadership team
About the Company
Zelis is modernizing the healthcare financial experience across payers, providers, and healthcare consumers. It serves more than 750 payers, including the top five national health plans, regional health plans, TPAs and millions of healthcare providers and consumers across its platform of solutions. Zelis sees across the system to identify, optimize, and solve problems holistically with technology built by healthcare experts – driving real, measurable results for clients.
Zelis is modernizing the healthcare financial experience by providing a connected platform that bridges the gaps and aligns interests across payers, providers, and healthcare consumers.
