Cybersecurity Architect - CyberArk (APAC IAM Production)

About the role

The APAC IAM Production team covers IT security governance, network security, vulnerability and compliance management, production CSIRT, detection and SIEM engineering, and support of security platforms. As the APAC IAM Production Cybersecurity Architect for CyberArk, you lead the design, implementation and continuous improvement of CyberArk vault and associated PAM solutions across all APAC operations. You report to the APAC Head of IAM Production and are accountable for securing, monitoring and governing privileged credentials and sessions.

Key responsibilities

• Own the enterprise-wide CyberArk architecture (Vault, CPM, PSM, PVWA, Conjur) supporting the bank's technical accounts inventory.
• Design and enforce privileged-access policies (least privilege, separation of duties, time-bound access) across Windows, Linux, UNIX, databases and cloud platforms (AWS, Azure, GCP).
• Provide high-availability support with monitoring, incident response and disaster-recovery processes keeping critical services running 24x7.
• Drive the secret-management lifecycle: automatic password rotation, SSH key management, API-credential vaulting and on-demand retrieval.
• Partner with engineering, application and cloud teams to embed secure identity controls in new services, migrations and upgrades.
• Automate PAM processes with PowerShell, Python and CyberArk REST APIs (bulk onboarding/offboarding, rotation schedules).
• Evaluate emerging PAM technologies and build business cases for adoption.
• Integrate privileged-access controls into CI/CD pipelines and cloud-native workloads with DevSecOps, Cloud and Application teams.

Required profile

• Minimum 8 years of experience as a security professional.
• Bachelor's degree in Computer Science, Information Security or a related field (Master's preferred).
• Proven track record of building high-availability identity platforms with monitoring, automated remediation and documented DR procedures.
• Client, customer and stakeholder focus, and a strong compliance culture.

Required skills

• Expert knowledge of CyberArk (Vault, PSM, CPM) and PAM solutions; L3-level Conjur expertise including policy-as-code and Kubernetes integration.
• Windows, UNIX, Linux authentication, Kerberos, LDAP/AD, SSH and database authentication.
• Integration with SSO/IdP (SAML, OIDC, AD) and familiarity with AWS Secrets Manager and Azure Key Vault.
• PowerShell, Python and CyberArk REST API for automation.
• CyberArk Certified Defender (CCD) and Conjur certification preferred.