Digital Identity Consultant " IAM & PKI "

Job Description:

Key Responsibilities

Architecture & Optimization

• Design highly available CyberArk vault clusters, SailPoint connector architecture, and Thales Root/Sub-CA hierarchy with M-of-N ceremonies.

• Define privileged-account onboarding standards, IGA birth-right roles and PKI certificate profiles aligned to zero-trust principles.

Advanced Support & RCA

• Final escalation point for CPM failure, vault corruption, SailPoint provisioning errors, MPASS OTP outage, or HSM card set issues.

• Conduct packet/protocol traces (LDAP, RADIUS, OCSP) and HSM log analysis; produce formal RCA and mitigation plans.

Security Compliance & Audit

• Map vault session logs, SailPoint certification data and CA event logs to SAMA evidence matrices; present to internal & external auditors.

• Lead quarterly privileged-access reviews and annual PKI key-ceremony documentation.

Automation & Integration

• Develop REST/CLI scripts to automate account onboarding, access review exports, certificate renewal and SIEM log forwarding (QRadar).

Leadership & Mentoring

• Create runbooks, lab environments and knowledge articles; coach two L2 IAM/PKI engineers and oversee their daily queue.

• Participate in vendor roadmap sessions and advise management on license & hardware scaling.

________________________________________

Required Qualifications

• Bachelors in computer science, Information Security or related.

• 7+ years dedicated IAM/PAM/PKI experience, incl. 3+ on CyberArk (Safe design, CPM/PSM), 2+ on SailPoint (cert campaigns, lifecycle manager), HSM-backed PKI (Thales Luna / CipherTrust) and enterprise MFA (MPASS or equivalent).

• Proven track-record leading key-ceremony operations and privileged-access audits for financial institutions under SAMA/NCA.

• Deep understanding of TLS, X.509, SSH, Kerberos, SAML/OIDC, SCIM, and REST.

• Experience automating with Python/PowerShell or REST APIs.

________________________________________

Desired Skills & Certifications

• CyberArk CDE, SailPoint IDN / IdentityIQ Engineer, Thales Luna CSP, CISSP or CCSP.

• ITIL v4, ISO 27001 Lead Implementer, or equivalent audit/ops framework.

• Familiarity with DevOps pipelines (Git, Ansible) for access-control automation.

________________________________________

Working Conditions

• Core hours Sun-Thu, 9×5, with participation in an on-call rota for P1 escalations and PKI key ceremonies.

• On-site data-centre presence during key operations.

• Must pass SAMA background screening and maintain strict confidentiality.

At DXC Technology, we believe strong connections and community are key to our success. Our work model prioritizes in-person collaboration while offering flexibility to support wellbeing, productivity, individual work styles, and life circumstances. We’re committed to fostering an inclusive environment where everyone can thrive.

Recruitment fraud is a scheme in which fictitious job opportunities are offered to job seekers typically through online services, such as false websites, or through unsolicited emails claiming to be from the company. These emails may request recipients to provide personal information or to make payments as part of their illegitimate recruiting process. DXC does not make offers of employment via social media networks and DXC never asks for any money or payments from applicants at any point in the recruitment process, nor ask a job seeker to purchase IT or other equipment on our behalf. More information on employment scams is available here.