Privileged Access Specialist (Cyberark)

Galderma is a global leader in the dermatology market present in approximately 90 countries. The company focuses on a science-based portfolio of premium flagship brands in Injectable Aesthetics, Dermatological Skincare, and Therapeutic Dermatology.

• Higher education in Information Technology, Information Security or equivalent experience.
• Minimum 5 years experience in privileged access management or IT security, including at least 3 years hands-on with CyberArk PAS/Privilege Cloud in production.
• Strong practical experience with Vault, CPM, PSM, and PVWA administration, privileged account onboarding, and policy configuration.
• Ability to create or maintain custom CPM plugins and PSM connectors for complex environments.
• Robust knowledge of Windows Server, Active Directory (including Kerberos, delegation, GPO tiering), Unix/Linux, and networking concepts such as TLS, firewalls, and load balancing.
• Proficiency in PowerShell scripting, REST API integration; Python is an advantage.
• Experience with secrets management (Conjur, Secrets Hub, CCP/CP, HashiCorp Vault) and integrating with CI/CD or Kubernetes pipelines.
• Experience in regulated environments (SOX/ITGC); GxP is an advantage.
• Experience producing audit evidence/documentation.
• Certified CyberArk Defender.
• Fluent in English.

Nice to have:

• Experience with Sentry.
• Exposure to SIA/just-in-time access models, OT/manufacturing environments, or cloud privileged access controls.

• Administer and operate Galderma's CyberArk platform, including Vault, CPM, PSM, PVWA, HTML5 Gateway, PTA, PSMP, and Identity/SIA components.
• Lead platform lifecycle activities such as upgrades, patching, disaster recovery testing, backup and restore, certificate management, and system hardening.
• Configure and maintain privileged access policies including password rotation, reconciliation, session isolation, recording, exclusive access, and dual control workflows.
• Onboard privileged accounts across Windows, Unix/Linux, databases, network devices, cloud environments, SaaS applications, and OT/manufacturing systems.
• Develop and maintain custom integrations with CPM plugins and PSM connectors for non-standard targets.
• Support privileged session inspection, monitoring, and recording, integrating with SIEM.
• Manage secrets and machine identities including Conjur, Secrets Hub, Credential Providers, and API key lifecycles.
• Contribute to PAM architecture and automation using REST API, PowerShell, and version control.
• Support audit and compliance requirements with documentation and evidence for privileged access controls.
• Maintain operational documentation and assist incident response, forensic review, and break-glass procedures with the IAM team.