Principal Identity Security Engineer - Privileged Access Management (PAM)

Boston Scientific is seeking a Principal Identity Security Engineer to provide advanced technical leadership for privileged access management and identity security architecture across a global medical technology environment. This role is a highly technical individual contributor position serving as a CyberArk subject matter expert for enterprise PAM and identity resilience.

Key Responsibilities

• Provide principal-level technical leadership for enterprise Privileged Access Management (PAM), identity security architecture, and privileged identity resilience.
• Design and implement secure, scalable PAM architectures, engineering standards, technical controls, and modernization solutions aligned with enterprise cybersecurity objectives.
• Act as a CyberArk subject matter expert, covering privileged account management, session monitoring, credential rotation, secrets management, remote access, and related identity security capabilities.
• Lead complex CyberArk engineering initiatives, including platform integration, upgrades, performance optimization, high availability, disaster recovery, and operational resilience.
• Develop secure privileged access patterns for administrators, service accounts, application identities, vendors, cloud workloads, databases, network devices, and other critical enterprise systems.
• Evaluate and recommend complementary identity security technologies, including BeyondTrust, Delinea, Microsoft Entra Privileged Identity Management, HashiCorp Vault, and other emerging platforms.
• Design and advance Zero Trust controls using least-privilege access, just-in-time access, zero standing privilege, and privileged identity threat detection capabilities.
• Strengthen security controls for human and non-human identities, including service accounts, machine identities, application identities, and emerging AI-agent identities.
• Integrate PAM capabilities with identity governance, Active Directory, Microsoft Entra ID, cloud platforms, security operations, monitoring, and enterprise technology services.
• Develop privileged access solutions for manufacturing and operational technology (OT) environments, including industrial control systems, manufacturing execution systems, laboratories, and validated systems.
• Partner with Manufacturing, Quality, Infrastructure, and Cybersecurity teams to implement controls while minimizing production disruption, operational risk, and regulatory impact.
• Design compensating controls, secure vendor-access solutions, and phased remediation approaches for legacy environments with technical or validation constraints.
• Translate applicable regulatory, audit, and security requirements into practical technical controls, engineering standards, and supporting documentation.
• Apply relevant cybersecurity and regulatory frameworks, including FDA requirements, ISO 13485, IEC 62443, NIST Cybersecurity Framework, and other applicable standards.
• Develop and validate privileged access recovery, emergency-access, and break-glass solutions to improve enterprise cyber resilience and business continuity.
• Provide technical expertise during security incidents, risk assessments, vulnerability remediation, control testing, and recovery exercises.
• Establish technical health indicators and security metrics to measure platform effectiveness, control adoption, resilience, and risk reduction.
• Troubleshoot complex identity security issues, perform root-cause analysis, and implement sustainable engineering improvements.
• Collaborate with enterprise architects, cybersecurity leaders, infrastructure engineers, cloud teams, and business stakeholders to align identity security solutions with enterprise requirements.
• Mentor engineers, contribute to architecture reviews, promote engineering best practices, and influence technical decisions across global teams.
• Evaluate emerging identity security technologies, threats, and industry practices to recommend improvements to enterprise security capabilities.

Required Qualifications

• Bachelor's degree in cybersecurity, computer science, engineering, information technology, or a related discipline, or equivalent practical experience.
• Minimum of 8 years of experience in cybersecurity engineering, identity security, security architecture, infrastructure security, or a closely related technical discipline.
• Minimum of 5 years designing, implementing, integrating, or supporting enterprise PAM solutions.
• Deep hands-on expertise with CyberArk, including privileged account management, credential management, session monitoring, platform integration, and security architecture.
• Strong knowledge of PAM architecture, identity security principles, privileged access controls, and secure authentication technologies.
• Experience designing and implementing enterprise-scale identity security solutions across on-premises, cloud, and hybrid environments.
• Demonstrated experience leading complex technical projects, developing engineering standards, and influencing enterprise architecture decisions.
• Strong understanding of Zero Trust, least privilege, privileged identity security, service account management, and secrets management.
• Experience implementing security controls, improving platform resilience, and addressing vulnerabilities or operational risks in critical enterprise environments.
• Experience collaborating with cross-functional technology, cybersecurity, and business teams to deliver complex security solutions.
• Strong analytical, troubleshooting, technical documentation, and communication skills, including the ability to explain complex concepts to technical and nontechnical stakeholders.

Technologies

• CyberArk
• BeyondTrust
• Delinea
• Microsoft Entra Privileged Identity Management
• HashiCorp Vault
• Microsoft Entra ID
• Active Directory
• Zero Trust
• Zero standing privilege
• FDA requirements
• ISO 13485
• IEC 62443
• NIST Cybersecurity Framework
• Industrial control systems
• Manufacturing execution systems

Preferred Qualifications

• Experience working in a large, global, or highly regulated enterprise, particularly in medical devices, health care, life sciences, pharmaceuticals, or manufacturing.
• Experience leading enterprise PAM implementations, CyberArk modernization initiatives, or privileged access recovery programs.
• Working knowledge of BeyondTrust, Delinea, Microsoft Entra Privileged Identity Management, HashiCorp Vault, One Identity, or comparable identity security technologies.
• Experience securing manufacturing, operational technology, industrial control systems, or validated environments.
• Knowledge of non-human identity security, service account governance, secrets management, machine identity controls, and cloud privilege management.
• Familiarity with applicable regulatory and security frameworks, including FDA 21 CFR Part 11, ISO 13485, IEC 62443, NIST SP 800-53, SOX, and HIPAA (where applicable).
• Experience designing high-availability architectures, disaster recovery solutions, and secure emergency-access processes for critical identity platforms.
• Experience mentoring engineers, contributing to technical communities, or establishing engineering best practices.
• Relevant professional certifications, including CyberArk, CISSP, CISM, CCSP, GIAC, or comparable Microsoft or cloud security certifications.

Location and Work Model

• Primary location: Arden Hills, MN (Hybrid)
• Additional locations: US-MN-Arden Hills; US-MA-Marlborough
• Hybrid requirement: In-office attendance at least three days per week

Employment Details

• Requisition ID: 637096
• Salary range: USD 102,100 to 194,000 per year
• Minimum salary: $102,100
• Maximum salary: $194,000

Additional Notes

• Boston Scientific will not offer sponsorship or take over sponsorship of an employment visa for this position at this time.
• Relocation assistance is not available for this position at this time.
• Certain US-based roles may require proof of vaccination if specified during the interview and selection process, with compliance to state and federal law and healthcare credentialing requirements.
• This role is deemed safety-sensitive and candidates will be subject to a prohibited substance test in compliance with applicable law.
• For MA positions: it is unlawful to require or administer a lie detector test for employment.

Education Requirement

Bachelor's degree in cybersecurity, computer science, engineering, information technology, or a related discipline, or equivalent practical experience.