Be an Early Applicant
Where agentic engineering and human experience converge to deliver enterprise outcomes.
The Role
Lead architecture for an enterprise CyberArk PAM migration and merger consolidation programme. Design vault migration, application credential-provider onboarding, identity federation, MFA migration, segregation controls, rollback strategies, governance, audit evidence, and regulatory sign-off. Mentor CyberArk engineers and present architecture decisions to technical, executive, security, and compliance stakeholders.
Summary Generated by Built In
Bounteous is a global AI Services firm where agentic engineering and human experience converge to deliver transformative business outcomes for the enterprise. We help organizations design, build, and scale AI-driven products, platforms, and processes. With more than 5,000 team members worldwide, Bounteous delivers AI that sticks, powering adoption and outcomes that move organizations from experimentation to true transformation. Bounteous is backed by New Mountain Capital, a New York-based growth-oriented investment firm that emphasizes business building.
CyberArk Architect
3+ months rolling contract
Newbury, UK
About the role
We are seeking a CyberArk Architect to lead solution design for a large-scale, TSA-regulated Privileged Access Management (PAM) migration and merger consolidation programme. This is a hands-on architecture role spanning vault migration design, identity federation, and application onboarding strategy for an estate spanning thousands of accounts and 250+ dependent applications, delivered against a fixed regulatory deadline.
Key responsibilities
Migration & vault architecture
- Design the end-to-end migration architecture from CyberArk v12.2 to v14.2, covering entity extraction (REST API primary, PACLI fallback), transformation, reconciliation, and staged loading into the target vault.
- Define the staged-ingestion model: disabled import → CPM soft-verification → dual-run mirroring → forced rotation at cutover — ensuring no credential is exposed to a script or human during migration.
- Own name-collision resolution, platform normalisation, and policy reconciliation rules between source and target environments.
- Produce migration runbooks, RAID logs, and effort-sizing models across Safes, Accounts, Platforms, and Policies.
Application & credential provider (CP/CCP) strategy
- Lead discovery to segment the 250+ dependent applications by integration pattern (CP agent, CCP centralised, Conjur, direct SSO) — the primary driver of onboarding sequencing and timeline risk.
- Design the CP/CCP re-onboarding approach, including AppID re-provisioning, certificate/mTLS re-issuance, and phased cutover waves.
- Define rollback and dual-run strategy per wave, including the read-only fallback window on the source vault.
Identity federation & MFA
- Design PVWA federation to Entra ID via SAML/OIDC, including claims mapping from Entra groups to CyberArk Vault Users and Safe membership.
- Architect the RSA SecurID → Entra MFA migration as a re-enrolment exercise, covering Conditional Access policy design and non-web/legacy client bridging (PrivateArk, PACLI, RADIUS-dependent flows).
- Ensure High Side / Low Side segregation is preserved across all federation and migration data flows, with no entitlement detail crossing the DMZ boundary.
Governance, compliance & stakeholder leadership
- Own architecture decisions and trade-offs; present designs to client security, compliance, and PAM leadership for sign-off.
- Ensure all migration and access-control designs produce audit evidence sufficient for TSA compliance reporting.
- Evaluate and position complementary tooling (e.g. Hydden for continuous identity discovery) against native CyberArk capability.
- Define acceptance criteria and go/no-go gates for pilot and production wave sign-off.
- Mentor and provide technical direction to CyberArk Senior Engineers delivering the build.
Required experience & skills
- 10+ years in Identity and Access Management, with 5+ years specifically in CyberArk PAM architecture and design.
- Deep hands-on knowledge of CyberArk EPV, PVWA, CPM, PSM, AAM/CCP, and Vault architecture across on-prem and Privilege Cloud deployments.
- Proven experience leading a CyberArk version migration (v10/v11/v12 → v13/v14) at enterprise scale.
- Strong working knowledge of SAML 2.0 and OIDC federation design, including experience integrating CyberArk PVWA with an enterprise IdP (Entra ID, Okta, or equivalent).
- Experience with credential provider architectures (CP, CCP) and application onboarding at scale (100+ application estates).
- Familiarity with MFA migration projects (e.g. RSA SecurID to a cloud MFA/Conditional Access model).
- Experience operating in regulated environments (financial services, telecom, or government) with formal change control and audit evidence requirements.
- Strong client-facing communication skills; able to present architecture to both technical and executive stakeholders.
Information Security Responsibilities
- Promote and enforce awareness of key information security practices, including acceptable use of information assets, malware protection, and password security protocols
- Identify, assess, and report security risks, focusing on how these risks impact the confidentiality, integrity, and availability of information assets
- Understand and evaluate how data is stored, processed, or transmitted, ensuring compliance with data privacy and protection standards (GDPR, CCPA, etc.)
- Ensure data protection measures are integrated throughout the information lifecycle to safeguard sensitive information
We invite you to stay connected with us by subscribing to our monthly job openings alert here.
Bounteous is proud to be an equal opportunity employer. Bounteous does not discriminate on the basis of race, religion, color, sex, gender identity, sexual orientation, age, physical or mental disability, national origin, veteran status, or any other status protected under federal, state, or local law. Bounteous is willing to sponsor eligible candidates for employment visas.
Skills Required
- 10+ years of experience in Identity and Access Management
- 5+ years of CyberArk PAM architecture and design experience
- Deep hands-on knowledge of CyberArk EPV, PVWA, CPM, PSM, AAM/CCP, and Vault architecture
- Experience with on-premises and Privilege Cloud CyberArk deployments
- Enterprise-scale CyberArk version migration experience from v10/v11/v12 to v13/v14
- Strong knowledge of SAML 2.0 and OIDC federation design
- Experience integrating CyberArk PVWA with Entra ID, Okta, or an equivalent enterprise identity provider
- Experience with CP and CCP architectures and application onboarding across 100+ applications
- Experience with MFA migration projects, such as RSA SecurID to cloud MFA or Conditional Access
- Experience in regulated environments with formal change control and audit evidence requirements
- Strong client-facing communication skills with technical and executive stakeholders
What the Team is Saying
Amanda
EVP, Operations
Abbey
VP of Business Development, Convenience Retailing
Jon
HelpDesk Manager
Markel
People Experience Advisor
Rhoben Cabangbang
Account Director
Ankit Jain
Vice President, Technology
Tom Sunnergren
VP, Experience Design
Preethi Somasundaram
Associate Technical Manager, Consumer
Melinda Ramos
Executive Vice President, People & Culture, Americas, Bounteous
Satish Kannan
EVP, Chief People Officer, APAC & EMEA
Rhoben Cabangbang
Account Director
Preethi Somasundaram
Associate Technical Manager, Consumer
Lina Stajic
Strategy, Insights, & Activation
Le’Rhone Walker
VP, Technology
Krishna Prasad TC
Director of Technical Delivery, Healthcare
Le’Rhone Walker
VP, Technology
Bounteous Compensation & Benefits Highlights
-
Healthcare Strength — Healthcare is considered strong, with employer-paid employee premiums reported alongside dental, vision, life/disability, mental-health support, and even pet insurance. Coverage quality is highlighted as a standout element of the package.
-
Leave & Time Off Breadth — Time off is positioned as flexible through take‑what‑you‑need/unlimited PTO, paid holidays, and Summer Fridays. A remote‑friendly approach also supports taking time when work allows.
-
Parental & Family Support — Parental and family benefits include paid parental leave, adoption assistance, childcare support, and family medical leave. These provisions round out family support beyond core insurance.
Bounteous Insights
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
Bounteous is a global AI Services firm where agentic engineering and human experience converge to deliver transformative business outcomes for the enterprise. We help organizations design, build, and scale AI-driven products, platforms, and processes. With more than 5,000 team members worldwide, Bounteous delivers AI that sticks, powering adoption and outcomes that move organizations from experimentation to true transformation.
Why Work With Us
Bounteous combines strategy, experience design, engineering, data, and AI to help leading brands build intelligent systems that are practical, scalable, and measurable. People join us to work on meaningful transformation initiatives, collaborate with smart and supportive teams, and help shape what’s next in AI and digital experience.
Gallery
Bounteous Offices
Remote Workspace
Employees work remotely.
Our remote-first teams of talented individuals collaborate and co-innovate worldwide. We believe productivity thrives anywhere, so you're empowered to work in the way and environment where you perform best.
Typical time on-site:
Frisco Headquarters
Bengaluru Collaboration Center
Boston Collaboration Center
Calgary Collaboration Center
Chennai Collaboration Center
Gurugram Collaboration Center
Hyderabad Collaboration Center
London Collaboration Center
Singapore
Learn more
