We are looking for a Security Engineer - PAM to join our Global Information Security - Identity and Access Management (IAM) group. This group is responsible for providing a Core IAM ecosystem of products and platforms in use across the company by cast members, employees, and partners within our business segments and corporate functions. Our vision is to provide modern Identity and Access Management capabilities and services that are simple, seamless, and secure to protect our workforce, our data, and our brands.
What You Ll Do
- Support the implementation and maintenance of enterprise PAM solutions including privileged account vaulting,
- session management, and credential rotation.
- Administer and operate PAM platforms (e.g., CyberArk, CA PAM) under the direction of senior engineers, ensuring platform policies are correctly applied.
- Assist with automation tasks for PAM onboarding, account provisioning, and reconciliation using PowerShell, Python, or REST APIs.
- Collaborate with IT and application teams to support PAM integrations, following established patterns and design guidance.
- Apply and maintain privileged account policies aligned with TWDC security standards and documented procedures. Support PAM-related access reviews and assist in gathering audit evidence as directed.
- Troubleshoot PAM platform issues with guidance from senior engineers, contributing to root cause analysis and documentation.
- Maintain team documentation, runbooks, and knowledge base articles based on operational experience.
- Identify and escalate opportunities to reduce the privileged access attack surface through improved tooling and process improvements.
Required Qualifications & Skills
- 3+ years of experience in cybersecurity, IT operations, or identity and access management.
- Foundational knowledge of PAM concepts: credential vaulting, session recording, just-in-time access, least privilege, and secrets management.
- Familiarity with enterprise PAM platforms such as CyberArk or CA PAM (Broadcom Privileged Access Manager).
- Basic scripting ability in PowerShell and/or Python for task automation.
- Understanding of Active Directory, LDAP, and enterprise identity concepts.
- Familiarity with compliance and audit processes in an IT security context (SOX, PCI-DSS, or similar frameworks).
- Ability to work effectively within cross-functional teams and follow structured engineering processes.
Preferred Qualifications
- Experience with DevOps secrets management tools such as HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault.
- Familiarity with Infrastructure as Code (Terraform) for platform deployment and configuration.
- Exposure to SIEM integrations and PAM telemetry for privileged session monitoring.
- Knowledge of Zero Trust architecture principles as applied to privileged access.
- Relevant certifications such as: CyberArk Defender, CompTIA Security+, or equivalent are a plus.
- Master s degree in Information Technology, Information Security, Computer Science, or Business related field or equivalent validated work experience.
Required Education
- Bachelor s degree in Computer Science, Information Systems, Software, Electrical or Electronics Engineering, or comparable field of study, and/or equivalent work experience.
Why Join Us
At our organization, technology powers the magic. As part of our team, you ll help build and maintain the systems that support our iconic brands and global operations. We offer a collaborative work environment, opportunities for growth, and a culture that celebrates diversity, creativity, and innovation.
