PAM Specialist

Role: PAM Specialist

Contract Length: initial contract 3 months

Location: hybrid working in Culham

Role Overview

The PAM Specialist will lead the hands-on implementation, configuration, and ongoing management of the organisation's Privileged Access Management (PAM) platform. Embedded within the Cyber Security team, the role is responsible for deploying and operating BeyondTrust Password Safe, Privileged Remote Access, and associated components to secure privileged access across the enterprise.

This is a highly technical, delivery-focused role requiring deep expertise in BeyondTrust PAM technologies. You will work closely with infrastructure teams, application owners, and security operations to ensure privileged accounts are securely vaulted, access is tightly controlled, sessions are monitored, and least-privilege principles are consistently enforced.

Key Accountabilities

• Implement, configure, and operate BeyondTrust Password Safe for enterprise credential vaulting
• Deploy and manage BeyondTrust Privileged Remote Access for secure administrator and third-party access
• Configure automated password rotation for privileged, service, and application accounts
• Implement privileged session monitoring, recording, and keystroke logging
• Design and configure Just-in-Time (JIT) access workflows and approval processes
• Onboard Windows, Linux/Unix Servers, network devices, and applications into the PAM platform
• Discover, onboard, and manage service accounts, application accounts, and shared credentials
• Configure Smart Rules for automated account discovery, onboarding, and life cycle management
• Implement session Proxy configurations for RDP, SSH, and application-based access
• Design and maintain break-glass and emergency access procedures
• Integrate BeyondTrust with SIEM platforms for security monitoring, alerting, and incident response
• Configure and maintain connectors for Active Directory, Entra ID, and target systems
• Manage platform upgrades, patching, availability, and health monitoring
• Troubleshoot connector failures, session issues, and platform errors
• Maintain detailed technical documentation, configuration standards, and operational runbooks
• Support audit, assurance, and compliance activities through reporting and evidence collection

Essential Requirements

• Proven hands-on experience implementing and managing BeyondTrust Password Safe
• Experience configuring and operating BeyondTrust Privileged Remote Access
• Strong understanding of credential vaulting, password rotation, and access workflows
• Experience implementing privileged session monitoring and recording
• Knowledge of service account discovery and life cycle management
• Experience onboarding Windows Server, Linux/Unix, and network devices into PAM platforms
• Strong understanding of Active Directory privileged account management
• Experience integrating PAM solutions with SIEM platforms for logging and alerting
• Working knowledge of security frameworks such as ISO 27001 and NIST CSF
• Strong troubleshooting skills across PAM connectors, sessions, and platform services
• Ability to produce clear technical documentation and operational runbooks
• Ability to obtain SC-level national security clearance

If you consider yourself to have a disability or if you are a veteran, and you meet the essential criteria for the role, you will be put forward for the Guaranteed Interview' scheme whereby you will have the opportunity to discuss this role and your suitability with a member of the Sourcing team.

How to Apply

• Quote the Job Title and Reference Number in your application.
• Submit your CV in Word format.
• Applications are reviewed on a rolling basis-early submission is recommended.

We will also add your details to our mail out lists. Please note you may receive details of roles outside of your immediate vicinity, as many candidates are able to relocate temporarily for work. Please disregard any such emails that are not of interest and let us know if you would rather not receive such mailouts and/or if you wish us to delete your details and prefer to apply direct to our advertised roles.

If you do not hear from us within three working days, unfortunately your application has not been shortlisted on this occasion. Thank you for your interest in working with us.