# CyberArk Architect

**Company**: Bounteous
**Location**: London
**Work arrangement**: remote
**Experience**: senior
**Job type**: Contract
**Category**: Security
**Industry**: Technology

**Apply**: https://jobs.lever.co/bounteous/26225228-9b9e-44ba-a103-b196a51a70da?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_cfe0f479-941

## Description

Bounteous is seeking a CyberArk Architect to lead solution design for a large-scale, TSA-regulated Privileged Access Management (PAM) migration and merger consolidation programme.

Key responsibilities:

- Migration & vault architecture: Design the end-to-end migration architecture from CyberArk v12.2 to v14.2, covering entity extraction, transformation, reconciliation, and staged loading into the target vault.

- Define the staged-ingestion model, own name-collision resolution, platform normalisation, and policy reconciliation rules between source and target environments.

- Produce migration runbooks, RAID logs, and effort-sizing models across Safes, Accounts, Platforms, and Policies.

- Application & credential provider (CP/CCP) strategy: Lead discovery to segment the 250+ dependent applications by integration pattern.

- Design the CP/CCP re-onboarding approach, including AppID re-provisioning, certificate/mTLS re-issuance, and phased cutover waves.

- Define rollback and dual-run strategy per wave, including the read-only fallback window on the source vault.

- Identity federation & MFA: Design PVWA federation to Entra ID via SAML/OIDC, including claims mapping from Entra groups to CyberArk Vault Users and Safe membership.

- Architect the RSA SecurID → Entra MFA migration as a re-enrolment exercise, covering Conditional Access policy design and non-web/legacy client bridging.

- Ensure High Side / Low Side segregation is preserved across all federation and migration data flows, with no entitlement detail crossing the DMZ boundary.

- Governance, compliance & stakeholder leadership: Own architecture decisions and trade-offs; present designs to client security, compliance, and PAM leadership for sign-off.

- Ensure all migration and access-control designs produce audit evidence sufficient for TSA compliance reporting.

- Evaluate and position complementary tooling against native CyberArk capability.

Required experience & skills:

- 10+ years in Identity and Access Management, with 5+ years specifically in CyberArk PAM architecture and design.

- Deep hands-on knowledge of CyberArk EPV, PVWA, CPM, PSM, AAM/CCP, and Vault architecture across on-prem and Privilege Cloud deployments.

- Proven experience leading a CyberArk version migration at enterprise scale.

- Strong working knowledge of SAML 2.0 and OIDC federation design, including experience integrating CyberArk PVWA with an enterprise IdP.

- Experience with credential provider architectures and application onboarding at scale.

- Familiarity with MFA migration projects.

- Experience operating in regulated environments with formal change control and audit evidence requirements.

- Strong client-facing communication skills; able to present architecture to both technical and executive stakeholders.

## Skills

### Required
- CyberArk PAM architecture
- Identity and Access Management
- SAML 2.0
- OIDC federation
- Credential provider architectures
- Application onboarding
- MFA migration
- Regulated environments

---

Source: [Apply at jobs.lever.co](https://jobs.lever.co/bounteous/26225228-9b9e-44ba-a103-b196a51a70da?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)