Principal Identity Security Engineer - Privileged Access Management (PAM)

Join Boston Scientific in a hybrid role where you will lead enterprise-grade identity security and privileged access engineering across a global medical technology environment. This position blends advanced technical leadership with deep, hands-on expertise as a CyberArk subject matter expert, strengthening security architecture, operational resilience, and privileged identity threat detection across on-premises, cloud, and hybrid systems.

What you’ll do

• Provide principal-level technical leadership for enterprise Privileged Access Management (PAM), identity security architecture, and privileged identity resilience.
• Design and implement secure, scalable PAM architectures, engineering standards, technical controls, and modernization solutions aligned with enterprise cybersecurity objectives.
• Serve as a CyberArk subject matter expert, covering privileged account management, session monitoring, credential rotation, secrets management, remote access, and related identity security capabilities.
• Lead complex CyberArk engineering initiatives including platform integration, upgrades, performance optimization, high availability, disaster recovery, and operational resilience.
• Develop secure privileged access patterns for administrators, service accounts, application identities, vendors, cloud workloads, databases, and network devices, including other critical enterprise systems.
• Evaluate and recommend complementary identity security technologies such as BeyondTrust, Delinea, Microsoft Entra Privileged Identity Management, HashiCorp Vault, and other emerging platforms.
• Advance Zero Trust security controls using least-privilege, just-in-time access, zero standing privilege, and privileged identity threat detection capabilities.
• Strengthen security controls for human and non-human identities, including service accounts, machine identities, application identities, and emerging AI-agent identities.
• Integrate PAM with identity governance and systems such as Active Directory and Microsoft Entra ID, plus cloud platforms, security operations, monitoring, and enterprise technology services.
• Design privileged access solutions for manufacturing and operational technology (OT), including industrial control systems, manufacturing execution systems, laboratories, and validated systems.
• Partner with Manufacturing, Quality, Infrastructure, and Cybersecurity teams to implement controls while minimizing production disruption, operational risk, and regulatory impact.
• Create compensating controls, secure vendor-access solutions, and phased remediation approaches for legacy systems with technical or validation constraints.
• Translate regulatory, audit, and security requirements into practical technical controls, engineering standards, and supporting documentation.
• Apply cybersecurity and regulatory frameworks including FDA requirements, ISO 13485, IEC 62443, NIST Cybersecurity Framework, and other applicable standards.
• Develop and validate privileged access recovery, emergency-access, and break-glass solutions to support cyber resilience and business continuity.
• Provide technical expertise during security incidents, risk assessments, vulnerability remediation, control testing, and recovery exercises.
• Establish technical health indicators and security metrics to evaluate platform effectiveness, control adoption, resilience, and risk reduction.
• Troubleshoot complex identity security issues, perform root-cause analysis, and implement sustainable engineering improvements.
• Collaborate with enterprise architects, cybersecurity leaders, infrastructure engineers, cloud teams, and business stakeholders to align identity security solutions with enterprise requirements.
• Mentor engineers, contribute to architecture reviews, promote engineering best practices, and influence technical decisions across global teams.
• Evaluate emerging identity security technologies, threats, and industry practices to recommend improvements to enterprise security capabilities.

What you bring

• Bachelor’s degree in cybersecurity, computer science, engineering, information technology, or a related discipline, or equivalent practical experience.
• Minimum 8 years of experience in cybersecurity engineering, identity security, security architecture, infrastructure security, or a closely related technical discipline.
• Minimum 5 years experience designing, implementing, integrating, or supporting enterprise Privileged Access Management solutions.
• Deep hands-on expertise with CyberArk, including privileged account management, credential management, session monitoring, platform integration, and security architecture.
• Strong knowledge of PAM architecture, identity security principles, privileged access controls, and secure authentication technologies.
• Experience designing and implementing enterprise-scale identity security solutions across on-premises, cloud, and hybrid environments.
• Demonstrated experience leading complex technical projects, developing engineering standards, and influencing enterprise architecture decisions.
• Strong understanding of Zero Trust, least privilege, privileged identity security, service account management, and secrets management.
• Experience implementing security controls, improving platform resilience, and addressing vulnerabilities or operational risks in critical enterprise environments.
• Experience collaborating with cross-functional technology, cybersecurity, and business teams to deliver complex security solutions.
• Strong analytical, troubleshooting, technical documentation, and communication skills, including the ability to explain complex security concepts to technical and nontechnical stakeholders.

Skills and tools

• CyberArk
• BeyondTrust
• Delinea
• Microsoft Entra Privileged Identity Management
• HashiCorp Vault
• Microsoft Entra ID
• Active Directory
• Zero Trust, Zero standing privilege
• FDA requirements, ISO 13485, IEC 62443, NIST Cybersecurity Framework
• Industrial control systems, manufacturing execution systems

Location and work model

• Arden Hills, MN (hybrid), with local office attendance required at least three days per week.
• Additional location: Marlborough, MA.

Compensation

• USD 102,100 - 194,000 per year
• Requisition ID: 637096

Additional job details

• Sponsorship: Boston Scientific will not offer sponsorship or take over sponsorship of an employment visa for this position at this time.
• Relocation: Relocation assistance is not available for this position at this time.
• For MA positions: it is unlawful to require or administer a lie detector test for employment.
• COVID-19 policy requirements may apply for certain roles; candidates are notified during the interview and selection process if proof of vaccination is required.
• This role is deemed safety-sensitive and candidates will be subject to a prohibited substance test as a requirement.

Preferred qualifications

• Experience working in a large, global, or highly regulated enterprise, particularly in medical devices, health care, life sciences, pharmaceuticals, or manufacturing.
• Experience leading enterprise PAM implementations, CyberArk modernization initiatives, or privileged access recovery programs.
• Working knowledge of BeyondTrust, Delinea, Microsoft Entra Privileged Identity Management, HashiCorp Vault, One Identity, or comparable identity security technologies.
• Experience securing manufacturing, operational technology, industrial control systems, or validated environments.
• Knowledge of non-human identity security, service account governance, secrets management, machine identity controls, and cloud privilege management.
• Familiarity with applicable regulatory and security frameworks, including FDA 21 CFR Part 11, ISO 13485, IEC 62443, NIST SP 800-53, SOX, and HIPAA, where applicable.
• Experience designing high-availability architectures, disaster recovery solutions, and secure emergency-access processes for critical identity platforms.
• Experience mentoring engineers, contributing to technical communities, or establishing engineering best practices.
• Relevant professional certifications, including CyberArk, CISSP, CISM, CCSP, GIAC, or comparable Microsoft or cloud security certifications.