Description
The Cyber Security Engineering Privileged Access Management team at London Stock Exchange Group (LSEG) is seeking an experienced Lead Engineer to design, implement, and manage enterprise-grade PAM solutions across multi-site and multi-cloud environments (AWS, Azure, GCP). You'll serve as a technical authority for PAM, shaping standards, delivering sophisticated migrations, and ensuring privileged access is secure, auditable, and resilient.
Key Responsibilities:
- Design and implement PAM capabilities (vaulting, session management/recording, credential rotation, least privilege, EPM/PRA) across on-prem and cloud workloads.
- Lead complex integrations with AD/EntraID, IdPs, SIEM/SOAR, CSPM, ITSM, DevOps tooling (CI/CD), and secrets management.
- Be responsible for the operational model: backup/recovery, DR, platform upgrades, policy hardening, performance tuning, and continuous improvement.
- Drive onboarding at scale ensuring standardized onboarding patterns and controls.
- Establish guardrails and RBAC/ABAC models aligned to Zero Trust and regulatory frameworks (ISO 27001, SOC 2, NIST 800-53/63).
- Define and maintain technical roadmaps, standards, and reference architectures; mentor engineers and review develop/runbooks.
- Lead security assessments, threat modeling, and control efficacy reviews; partner with risk/compliance and audit functions on evidence and remediation.
- Solve complex issues end-to-end, including proxy/connector components, high-availability clusters, and multi-region architectures.
Technical / job functional knowledge:
- Consistent record implementing and operating PAM at scale in complex enterprises (multi-site, multi-cloud).
- Hands-on expertise with at least one of the top PAM vendors (e.g., CyberArk, Delinea, BeyondTrust, One Identity), including deployment, integration, and automation.
- Solid understanding of Windows/Linux administration, AD/EntraID, networking and database fundamentals (TLS/PKI, proxies, firewalls), and identity protocols (SAML/OIDC/OAuth).
- Automation proficiency (PowerShell, Python, REST APIs) and Infrastructure-as-Code (Terraform/CloudFormation) for repeatable deployments.
- Experience with SIEM (e.g., Splunk, Sentinel, QRadar) and SOAR integrations for session telemetry, alerts, and response.
- Proven leadership in defining standards, runbooks, and governance; excellent customer engagement and interpersonal skills.
Additional desired capabilities:
- Experience with endpoint privilege management (Windows/macOS/Linux), JIT access, and Kubernetes/containers.
- Exposure to segmentation and network security (micro-segmentation, PAM proxies, bastion hosts).
- Relevant certifications (e.g., CyberArk Defender/Sentry, Azure/AWS Security, CISSP, CCSP).