IAM/PAM PKI Engineer Permanent

IAM / PAM / PKI Engineer (mPass, CyberArk)

Location: Riyadh, Saudi Arabia
Department: Cybersecurity – Identity & Access Management
Nationality Requirement: Saudi Nationals Only

Job Summary

We are seeking an experienced Identity & Access Management Engineer to support and enhance enterprise identity security capabilities, with a primary focus on MFA (Cerebra mPass) and PAM (CyberArk).

The role will be responsible for stabilising day-to-day operations, driving onboarding and policy improvements, and contributing to the roadmap for future identity initiatives including Windows Hello for Business, SailPoint (IGA), BeyondTrust (PAM), and Thales HSM for PKI.

A strong focus on troubleshooting, documentation, and audit-ready processes is essential.

Key Responsibilities

Multi-Factor Authentication (MFA – Cerebra mPass)

• Design, configure, and support MFA policies, integrations, and user onboarding
• Integrate MFA across enterprise systems (VPN, remote access, cloud and internal applications) using standard authentication protocols
• Monitor authentication flows, troubleshoot access issues, and enhance user experience
• Support migration planning and execution towards Windows Hello for Business

Privileged Access Management (PAM – CyberArk / Future BeyondTrust)

• Manage and optimise CyberArk environments (safes, platforms, CPM/PSM health, onboarding, password rotations)
• Drive privileged account onboarding and enforce governance controls (RBAC, session monitoring, vault policies)
• Support evaluation and future migration to alternative PAM platforms where required

Identity Governance & Administration (IGA – Future State)

• Support readiness for IGA implementation including joiner/mover/leaver processes and segregation of duties
• Contribute to planning, design, and operational runbooks for future adoption

PKI & Certificate Management (Future State – HSM Integration)

• Coordinate certificate lifecycle management and integrations with identity and infrastructure teams
• Support certificate inventory, renewal tracking, and operational processes
• Assist in planning for HSM-backed PKI environments, including governance and operational readiness

Operations, Compliance & Governance

• Ensure IAM, MFA, and PAM events are integrated with SIEM tools
• Maintain operational KPIs and reduce alert noise
• Execute changes through ITSM processes with appropriate validation and rollback procedures
• Support root cause analysis (RCA) for incidents
• Develop and maintain SOPs, runbooks, and documentation
• Provide audit-ready evidence aligned with regulatory and cybersecurity requirements

Automation & Continuous Improvement

• Develop automation scripts using PowerShell, Python, or APIs
• Automate onboarding, reporting, and operational tasks to improve efficiency

Required Qualifications

• Saudi National
• Bachelor’s degree in IT, Cybersecurity, or related field (or equivalent experience)
• Minimum 5+ years of experience in IAM environments
• Hands-on experience with MFA and PAM technologies at enterprise scale
• Strong experience with MFA platforms (e.g., Cerebra mPass or similar) and CyberArk
• Solid understanding of identity protocols (SAML, OAuth 2.0, OpenID Connect, LDAP, Active Directory)
• Strong troubleshooting, communication, and documentation skills
• Experience with scripting (PowerShell or Python) and working with APIs

Preferred Qualifications

• Experience with enterprise MFA rollouts and user adoption strategies
• Exposure to Windows Hello for Business, SailPoint, or BeyondTrust
• Experience working in regulated environments with audit and compliance requirements
• Relevant certifications (CyberArk, Microsoft Identity, CISSP, CISM, ITIL)

Working Model

• Riyadh-based role
• Standard business hours
• Occasional out-of-hours support for planned changes or critical incidents