bounteous - CyberArk Architect

• Migration & vault architecture • Design the end-to-end migration architecture from CyberArk v12.2 to v14.2, covering entity extraction (REST API primary, PACLI fallback), transformation, reconciliation, and staged loading into the target vault. • Define the staged-ingestion model: disabled import → CPM soft-verification → dual-run mirroring → forced rotation at cutover — ensuring no credential is exposed to a script or human during migration. • Own name-collision resolution, platform normalisation, and policy reconciliation rules between source and target environments. • Produce migration runbooks, RAID logs, and effort-sizing models across Safes, Accounts, Platforms, and Policies. • Application & credential provider (CP/CCP) strategy • Lead discovery to segment the 250+ dependent applications by integration pattern (CP agent, CCP centralised, Conjur, direct SSO) — the primary driver of onboarding sequencing and timeline risk. • Design the CP/CCP re-onboarding approach, including AppID re-provisioning, certificate/mTLS re-issuance, and phased cutover waves. • Define rollback and dual-run strategy per wave, including the read-only fallback window on the source vault. • Identity federation & MFA • Design PVWA federation to Entra ID via SAML/OIDC, including claims mapping from Entra groups to CyberArk Vault Users and Safe membership. • Architect the RSA SecurID → Entra MFA migration as a re-enrolment exercise, covering Conditional Access policy design and non-web/legacy client bridging (PrivateArk, PACLI, RADIUS-dependent flows). • Ensure High Side / Low Side segregation is preserved across all federation and migration data flows, with no entitlement detail crossing the DMZ boundary. • Governance, compliance & stakeholder leadership • Own architecture decisions and trade-offs; present designs to client security, compliance, and PAM leadership for sign-off. • Ensure all migration and access-control designs produce audit evidence sufficient for TSA compliance reporting. • Evaluate and position complementary tooling (e.g. Hydden for continuous identity discovery) against native CyberArk capability. • Define acceptance criteria and go/no-go gates for pilot and production wave sign-off. • Mentor and provide technical direction to CyberArk Senior Engineers delivering the build. • Promote and enforce awareness of key information security practices, including acceptable use of information assets, malware protection, and password security protocols • Identify, assess, and report security risks, focusing on how these risks impact the confidentiality, integrity, and availability of information assets • Understand and evaluate how data is stored, processed, or transmitted, ensuring compliance with data privacy and protection standards (GDPR, CCPA, etc.) • Ensure data protection measures are integrated throughout the information lifecycle to safeguard sensitive information • We invite you to stay connected with us by subscribing to our monthly job openings alert here.