APAC IAM Production Cybersecurity Architect - CyberArk

About the role

The APAC IAM Production-Cybersecurity Architect leads the design, implementation and continuous improvement of CyberArk vault and associated PAM solutions across all APAC operations. Reporting to the APAC Head of IAM Production, the role is accountable for securing, monitoring and governing privileged credentials and sessions, reducing the risk of credential theft, insider abuse and lateral movement. Candidates are assessed on four performance drivers: expert CyberArk knowledge, L3 Conjur expertise, a proven track record of resilient identity platforms, and a client, customer and stakeholder focus.

Key responsibilities

• Define and own the enterprise-wide CyberArk architecture (Vault, CPM, PSM, PVWA, Conjur) supporting the bank's technical accounts inventory.
• Design and enforce privileged-access policies (least privilege, separation of duties, time-bound access) across Windows, Linux, UNIX, databases and cloud platforms (AWS, Azure, GCP).
• Provide high-availability support with monitoring, incident response and disaster-recovery processes keeping critical services running 24x7.
• Drive the secret-management lifecycle: automatic password rotation, SSH key management, API-credential vaulting and on-demand retrieval.
• Partner with engineering, application and cloud teams to embed secure identity controls in new services, migrations and upgrades.
• Automate PAM processes with PowerShell, Python and CyberArk REST APIs (bulk onboarding/offboarding, rotation schedules).
• Evaluate emerging PAM technologies and build business cases for adoption.
• Work with DevSecOps, Cloud and Application teams to embed privileged-access controls in CI/CD pipelines and cloud-native workloads.

Required profile

• Minimum 8+ years of experience as a security professional.
• Bachelor's degree in Computer Science, Information Security or a related field (Master's preferred).
• Proven track record of building high-availability identity platforms with monitoring, automated remediation and documented DR procedures.
• Excellent communication skills, able to influence and collaborate with business executives and technical teams under pressure.

Required skills

• CyberArk (Vault, CPM, PSM, PVWA, Conjur) at enterprise scale; L3 Conjur expertise including policy-as-code (HCL), secret rotation, Kubernetes sidecar injection and API/CLI integrations.
• Windows, UNIX, Linux authentication, Kerberos, LDAP/AD, SSH and database authentication.
• Integration with SSO/IdP (SAML, OIDC, AD) and familiarity with AWS Secrets Manager and Azure Key Vault.
• PowerShell, Python and CyberArk REST API for automation.
• CyberArk Certified Defender (CCD) and Secrets Manager (Conjur) certifications.