What are the responsibilities and job description for the PAM Lead — Privileged Access Management position at Synapse Business Systems?
Key Responsibilities
- Serve as a senior point of accountability for privileged access operations and delivery, providing direction and coordination across PAM team activities and workstreams.
- Own the administration, operation, and health of the CyberArk platform (vault, PSM, CPM, PVWA, and related components), including onboarding, policy management, session monitoring, and platform upgrades/patching.
- Drive privileged account remediation programs: discovery of unmanaged and orphaned privileged accounts, vaulting and rotation of credentials, elimination of standing privileges, and cleanup of legacy access across Linux, Windows, and Active Directory environments.
- Maintain and strengthen PAM governance: access certification and recertification campaigns, policy and standards ownership, exception management, and reporting to risk, audit, and compliance stakeholders.
- Manage privileged access across Windows Server and Linux/UNIX estates, including local administrator accounts, root/sudo access, service accounts, and break-glass procedures.
- Oversee Active Directory privileged access, including tiered administration, domain admin and privileged group hygiene, and integration of AD accounts into the PAM platform.
- Partner with Identity & Access Management, Information Security, Infrastructure, and Audit teams to align PAM controls with regulatory and internal policy requirements.
- Respond to audit findings and regulatory inquiries related to privileged access; own remediation plans through to closure with evidence.
- Provide metrics, KPIs, and executive reporting on PAM program health, remediation progress, and risk reduction.
- Document processes and support knowledge transfer to ensure sustainability of PAM operations beyond the engagement.
Required Qualifications
- 8 years of experience in identity and access management or information security, with 4 years focused on privileged access management, including experience leading programs, workstreams, or teams.
- Deep, hands-on expertise with CyberArk (Privilege Cloud and/or self-hosted PAS): vault administration, CPM/PSM configuration, safe and platform design, account onboarding, and troubleshooting.
- Strong working knowledge of both Linux/UNIX and Windows Server environments as they relate to privileged access (root/sudo models, local admin management, service accounts) — this is a must.
- Solid Active Directory expertise: privileged groups, delegation models, tiered admin architecture, GPOs relevant to privileged access, and AD integration with PAM tooling.
- Demonstrated experience leading privileged account remediation efforts at scale (discovery, vaulting, rotation, decommissioning) in a large or regulated enterprise.
- Experience with PAM governance: certification campaigns, policy development, audit response, and control evidence in a regulated (preferably financial services) environment.
- Strong stakeholder management and communication skills; able to operate at both executive and engineering levels.
- Ability to work a hybrid schedule from the client’s New York City office (3 days onsite / 2 days remote).
Preferred Qualifications
- Prior experience in banking, capital markets, asset management, or another regulated financial services environment.
- CyberArk certifications (Defender, Sentry, or Guardian) and/or security certifications such as CISSP or CISM.
- Familiarity with adjacent IAM tooling (e.g., SailPoint, Okta/Entra ID) and endpoint privilege management (CyberArk EPM or similar).
- Scripting skills (PowerShell, Bash, Python) for automation of onboarding, reporting, and remediation tasks.
- Experience managing PAM in hybrid environments (on-prem and cloud — AWS/Azure privileged access).