Senior CyberArk Operations Engineer

At Bristol Myers Squibb, our employees often ask, “Who are you working for?”—a question that fuels collaboration, accountability, and urgency in our work. Our purpose-driven culture inspires us to discover, develop, and deliver innovative medicines to prevail over serious diseases. We offer uniquely interesting and meaningful work, opportunities for growth, and a supportive environment that values inclusion, wellbeing, flexibility, and comprehensive benefits. This is work that transforms the lives of patients, and the careers of those who do it.

We are seeking an experienced Senior CyberArk Operations Engineer to take ownership of our CyberArk privileged access management infrastructure and the integrations that support password management and retrieval across the enterprise. Our privileged access estate is moving to the CyberArk SaaS model, and the successful candidate must bring hands-on experience of operating CyberArk in a SaaS deployment together with a working understanding of the migration path from self-hosted to SaaS — whether to complete remaining migration waves or to stabilise, optimise, and run the platform once the transition is complete. The role also holds design and delivery ownership for the introduction of secrets management for application and DevOps teams and the redesign of the PMUL and ADB scope and control model. Beyond day-to-day responsibility for platform health, upgrades, and third-party integration, the successful candidate will act as the accountable owner for privileged access control decisions, progressively convert routine operational work into automation and self-service, and build PAM capability across the wider team.

Own the installation, configuration, and maintenance of CyberArk vault server infrastructure, ensuring compatibility and seamless integration with third-party systems for password management and retrieval. Own the operation and optimisation of the CyberArk SaaS environment — tenant and connector architecture, connector capacity and resilience, integration health, vendor release and feature adoption, and validation that privileged access controls operate as designed in the SaaS model. Lead any remaining migration or onboarding waves to the SaaS platform, including integration re-establishment, cutover sequencing, rollback planning, and post-migration control validation, and drive the decommissioning and clean-up of legacy self-hosted components. Design and deliver the introduction of secrets management for application and DevOps teams, including the onboarding pattern, integration of secrets retrieval into build and deployment pipelines, and the retirement of hardcoded and embedded credentials. Define the target scope and control model for PMUL and ADB and own the operational transition to it. Collaborate with cross-functional teams to identify integration requirements and design solutions that meet business needs while adhering to security and operational standards. Configure and maintain integrations between CyberArk and other password management products, such as Active Directory, LDAP, SSO solutions, and cloud-based identity providers. Monitor the health and performance of integrated systems, troubleshooting issues and optimizing configurations to ensure smooth operation, and act as the final escalation point for complex CyberArk and BeyondTrust faults. Develop custom scripts, automation workflows, and API-based integrations to streamline password management processes and enhance system interoperability, with a standing mandate to reduce recurring privileged access ticket volume through self-service and automation. Plan and execute software upgrades, patches, and maintenance activities for CyberArk and integrated systems, including impact assessment and control validation, ensuring minimal disruption to operations. Act as the accountable owner for privileged access control decisions — approval judgement on elevated and non-standard