# Lead Engineer

**Company**: London Stock Exchange Group (LSEG)
**Location**: IND-BLR-Divyasree Technopolis
**Experience**: senior
**Job type**: full-time
**Category**: Engineering
**Industry**: Finance

**Apply**: https://lseg.wd3.myworkdayjobs.com/en-US/Careers/job/IND-BLR-Divyasree-Technopolis/Lead-Engineer_R0114724-1?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_510254f6-f59

## Description

The Cyber Security Engineering Privileged Access Management team at London Stock Exchange Group (LSEG) is seeking an experienced Lead Engineer to design, implement, and manage enterprise-grade PAM solutions across multi-site and multi-cloud environments (AWS, Azure, GCP). You'll serve as a technical authority for PAM, shaping standards, delivering sophisticated migrations, and ensuring privileged access is secure, auditable, and resilient.

Key Responsibilities:

- Design and implement PAM capabilities (vaulting, session management/recording, credential rotation, least privilege, EPM/PRA) across on-prem and cloud workloads.

- Lead complex integrations with AD/EntraID, IdPs, SIEM/SOAR, CSPM, ITSM, DevOps tooling (CI/CD), and secrets management.

- Be responsible for the operational model: backup/recovery, DR, platform upgrades, policy hardening, performance tuning, and continuous improvement.

- Drive onboarding at scale ensuring standardized onboarding patterns and controls.

- Establish guardrails and RBAC/ABAC models aligned to Zero Trust and regulatory frameworks (ISO 27001, SOC 2, NIST 800-53/63).

- Define and maintain technical roadmaps, standards, and reference architectures; mentor engineers and review develop/runbooks.

- Lead security assessments, threat modeling, and control efficacy reviews; partner with risk/compliance and audit functions on evidence and remediation.

- Solve complex issues end-to-end, including proxy/connector components, high-availability clusters, and multi-region architectures.

Technical / job functional knowledge:

- Consistent record implementing and operating PAM at scale in complex enterprises (multi-site, multi-cloud).

- Hands-on expertise with at least one of the top PAM vendors (e.g., CyberArk, Delinea, BeyondTrust, One Identity), including deployment, integration, and automation.

- Solid understanding of Windows/Linux administration, AD/EntraID, networking and database fundamentals (TLS/PKI, proxies, firewalls), and identity protocols (SAML/OIDC/OAuth).

- Automation proficiency (PowerShell, Python, REST APIs) and Infrastructure-as-Code (Terraform/CloudFormation) for repeatable deployments.

- Experience with SIEM (e.g., Splunk, Sentinel, QRadar) and SOAR integrations for session telemetry, alerts, and response.

- Proven leadership in defining standards, runbooks, and governance; excellent customer engagement and interpersonal skills.

Additional desired capabilities:

- Experience with endpoint privilege management (Windows/macOS/Linux), JIT access, and Kubernetes/containers.

- Exposure to segmentation and network security (micro-segmentation, PAM proxies, bastion hosts).

- Relevant certifications (e.g., CyberArk Defender/Sentry, Azure/AWS Security, CISSP, CCSP).

## Skills

### Required
- PAM solutions
- CyberArk
- Delinea
- BeyondTrust
- One Identity
- PowerShell
- Python
- REST APIs
- Terraform
- CloudFormation
- SIEM
- SOAR
- Splunk
- Sentinel
- QRadar
- Windows/Linux administration
- AD/EntraID
- networking
- database fundamentals
- TLS/PKI
- proxies
- firewalls
- identity protocols
- SAML/OIDC/OAuth

### Nice to have
- endpoint privilege management
- JIT access
- Kubernetes/containers
- segmentation
- network security
- micro-segmentation
- PAM proxies
- bastion hosts
- CyberArk Defender/Sentry
- Azure/AWS Security
- CISSP
- CCSP

---

Source: [Apply at lseg.wd3.myworkdayjobs.com](https://lseg.wd3.myworkdayjobs.com/en-US/Careers/job/IND-BLR-Divyasree-Technopolis/Lead-Engineer_R0114724-1?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)