PAM Engineer (CyberArk)

Salary: £114,400 - 140,400 per year

Requirements:

• Extensive hands-on experience with BeyondTrust Endpoint Privilege Management (EPM) administration and engineering.
• Strong understanding of Windows endpoint security architecture.
• Proven experience creating, modifying, and troubleshooting BeyondTrust EPM policies.
• Experience supporting application packaging and software deployment processes.
• Strong knowledge of Windows desktop operating systems, application control, privilege elevation, endpoint security, software packaging and deployment, and Group Policy administration.
• Ability to analyse software requirements and design effective privilege management solutions.
• Experience supporting highly customised enterprise EPM environments.
• Excellent troubleshooting and root cause analysis skills.
• Experience working within secure, controlled, or highly regulated environments.
• Strong documentation and technical communication skills.
• Ability to work independently in a complex operational setting.
• Desirable: experience with CyberArk Endpoint Privilege Manager (EPM).
• Desirable: experience migrating between endpoint privilege management platforms.
• Desirable: knowledge of Microsoft Intune, MECM/SCCM, or similar endpoint management solutions.
• Desirable: PowerShell scripting and automation experience.
• Desirable: experience supporting large-scale enterprise endpoint estates.
• Desirable: familiarity with ITIL-based operational environments.
• Must be eligible for BPSS clearance.
• Must be able to work 5 days per week onsite in Manchester or Inverness.
• Must be available to participate in a 24x7 support rota.

Responsibilities:

• Administer, support, and maintain a highly customised BeyondTrust EPM platform.
• Design, implement, and manage policies covering privilege elevation, application control, allow-listing, and endpoint security.
• Collaborate with Application Packaging and Endpoint Engineering teams to support application deployment and compatibility.
• Analyse application requirements and define appropriate privilege management solutions.
• Troubleshoot complex endpoint privilege management and application control issues.
• Develop, test, and deploy policy changes while maintaining operational stability and security.
• Support the onboarding of new applications into the EPM environment.
• Investigate and resolve incidents relating to privilege elevation, application execution, and endpoint security controls.
• Work closely with infrastructure, packaging, and security teams to ensure seamless service delivery.
• Produce and maintain technical documentation, support procedures, and operational standards.
• Contribute to continuous improvement initiatives and platform optimisation activities.

Technologies:

• Support
• ITIL
• Microsoft Intune
• PowerShell
• Security
• Windows

More:

We are recruiting for two contract PAM/EMP Engineers to support a large-scale, highly customised endpoint privilege management environment within a secure enterprise setting. This is a 3-month contract based in Manchester, with 5 days onsite, paying £440 to £540 per day inside IR35. The role offers the opportunity to work closely with Application Packaging, Endpoint Engineering, and Security teams on the ongoing operation, optimisation, and enhancement of a complex EPM estate. Candidates with CyberArk Endpoint Privilege Manager experience who are interested in cross-training into BeyondTrust EPM are also encouraged to apply. We value respect, equality, and inclusion, and we support reasonable adjustments during the recruitment process.

last updated 34 week of 2026