About the Position

We are seeking a Senior PAM Engineer (CyberArk) to join our team in Ho Chi Minh City, Vietnam. You will take ownership of a mature, production-critical CyberArk Privileged Access Management platform that protects privileged access across a financial-services group. This is a transfer, not a greenfield build: the self-hosted estate - Vault and DR Vault, CPM, PVWA, PSM, PSMP - has been run from our European engineering center for years, and you will spend your first months working directly with the engineers who build and run it today before taking it over. If you want to inherit a well-documented platform with genuinely hard operational problems and a European team that hands over properly, this is that role.

Responsibilities

Keep the full CyberArk estate available, healthy, and performant - Vault and DR Vault, CPM, PVWA, PSM, and PSMP, across production and non-production.
Plan and run component-by-component upgrades of a distributed CyberArk estate - test first, production after, with rollback thinking at every step.
Troubleshoot the hard failures: broken connections and sessions, credential-rotation failures, certificate, and client-side issues; raise and drive CyberArk support cases.
Administer and harden the underlying Windows Server and Linux hosts - OS patching, AppLocker for PSM, GPO, and coexistence with endpoint-security tooling.
Support engineer and administrator users and lead incident response during outages, with honest root-cause writeups; participate in an on-call rotation.
Build and maintain custom platforms and PSM connectors for target systems, including web applications.
Operate the web tier and load balancing - SSL/TLS certificate renewal and deployment, IIS, and HAProxy failover in front of the platform.
Automate routine operations and reporting via PowerShell and the CyberArk REST API - account onboarding, health checks, usage, and license reports.
Keep runbooks and upgrade and troubleshooting knowledge current in the team's SharePoint portal.

Requirements

Solid hands-on experience operating CyberArk Self-Hosted PAM (Core PAS) in production - Vault, CPM, PVWA, PSM. You have upgraded it, not only administered it.
CyberArk Certified Sentry (PAM) - a hard requirement, as it is the prerequisite for the CDE certification the team works towards (fully funded and supported).
Strong Windows Server and Active Directory administration - authentication, group policy, hardening, service accounts - plus working Linux administration for the components that run on it.
Practical certificate and web-tier skills: HTTP/HTTPS, TLS, creating, renewing, and troubleshooting certificates, and IIS administration.
Load-balancing and failover experience (HAProxy or equivalent), and networking fundamentals to tell whether a problem is CyberArk, DNS, the load balancer, or a firewall rule.
Scripting and automation with PowerShell, and comfort working with REST APIs.
Methodical troubleshooting - the patience to isolate a problem rather than restarting services and hoping.
Fluent English (C1 or equivalent), spoken and written, for daily contact with European colleagues and English technical documentation.

Nice to Have

PSM connector and custom platform development
Regulated or financial-services experience
Exposure to another PAM product such as Delinea or BeyondTrust

We Offer

Join EmbedIT family and enjoy 20+ years of engineering expertise delivering large-scale IT transformation and fintech solutions.
Impact platforms used by 140M+ users across Europe and Asia.
Join a 500+ global engineering community working across 8 time zones.
Work in a truly international environment, collaborating with teams across Czech Republic and APAC.
Hybrid and flexible working setup that supports work-life balance.
Competitive compensation package including base salary, allowances, 13th-month salary, and performance bonuses.
Premium healthcare insurance, 24/7 accident coverage, and annual health checkups.
Extra perks including meal allowance, phone allowance, company laptop, and parking support.

About the Company

Our company is a dynamic fusion of innovation, skill, and vision, dedicated to transforming industries through technology. In this landscape, your unique talents and perspective are the keys to our collective success, contributing to groundbreaking solutions and strategies. Here, you're not just a part of the team; you're a vital contributor to a journey of continuous improvement and exceptional results. Join us, and let's shape the future together, where your growth is an integral part of our shared story.

Our Benefits

Time off: Everyone is entitled to 5 weeks of paid holiday per year. Plus up to 5 days of personal time off for personal illness or illness of immediate family member.
Meal contribution: While you’re at work, we make your meals more affordable. Of the meals you buy at any of our office locations, EmbedIT pays 55% of what you spend.
Flexible work: Our core working hours are from 9:00 to 15:00 daily, but how early you start or how late you work, is up to you. Our hybrid setup includes the option of working from your home.
Pension Insurance or Long-term Investment product: Everyone is entitled to a pension insurance allowance of CZK 2,000 per month.
Health & Care: Our people have access to premium healthcare or a 500 CZK monthly allowance for health activities and relaxation – whatever works best for them!
Recharge by PPF: We reward your loyalty with Recharge: one extra month of leave for every five years worked.
Discount programs: We have negotiated savings on your behalf at O2, Air Bank, Makro, Home Credit, and other vendors.
Personal growth: Professional growth is an essential part of our work-we actively support skill development, hands-on experience, and participation in exciting projects.
Other cool things you can expect: Annual all staff parties, fun teambuildings, sport events, and our Fail Forward sessions – where we openly share lessons learned from projects to foster growth and innovation.

Our Hiring Process

Expect a concise hiring process focused on evaluating your fit through an application review, a skills interview, and a culture fit discussion. Our goal is to ensure clarity and feedback throughout.

Here’s what you can expect

Application: Start by submitting your application through our online portal. Make sure to showcase your skills, experiences, and enthusiasm for the position.
Screening: Our recruitment team will carefully review your application to assess your qualifications and alignment with the role. If you meet the criteria, we will reach out to schedule an initial screening call or interview.
Interviews: During the interview stage, you’ll have the opportunity to showcase your capabilities and learn more about EmbedIT’s culture and expectations. Depending on the position, you may participate in multiple rounds of interviews with various team members and stakeholders.
Assessments: For certain roles, we may conduct assessments or technical tests to evaluate your skills and suitability for the position. The assessments help us ensure a good fit between your abilities and the requirements of the role.
Offer: If you successfully complete the interview and assessment stages, we’ll extend a job offer to you. This offer will include details about compensation, benefits, and other pertinent information.
Onboarding: Once you accept our offer, we’ll guide you through our onboarding process which includes orientation sessions, training, and introductions to your team and key stakeholders, and assign you a “buddy” to help get you settled. We want to ensure that you feel welcome and prepared as you begin your journey at EmbedIT.

Apply for this Position

Let’s talk about the details in person. Get in touch with us.

Apply now
Send to a friend

You will be taken to a website of PPF Group, the enterprise we belong to.

Senior PAM Engineer (CyberArk)

Job description