Cyber Identity - Pam/non Human Identity Senior Consultant

Deloitte Deloitte · Consulting

This role focuses on securing machine, service, and application identities within cloud and hybrid environments. It involves assessing risks, designing and implementing controls for governance, secrets management, and privileged access for non-human identities. The consultant will advise on architecture, operating procedures, and implementation plans, and lead project workstreams. The role requires experience with Privileged Access Management or secrets management solutions and various related technologies like credential rotation, service account governance, and automation scripting.

What you'd actually do

  1. Assessing client environments to identify Non-Human Identity risks, including secrets sprawl, over-permissioned service accounts, orphaned credentials, and lifecycle governance gaps
  2. Designing and deploying governance, privileged access, and secrets management capabilities for non-human identities across cloud, hybrid, and containerized platforms
  3. Implementing controls such as credential vaulting, automated rotation, just-in-time access, workload identity federation, and application credential integrations using enterprise and cloud-native tools
  4. Advising clients on Non-Human Identity architecture, operating procedures, and implementation plans, including high-level design, low-level design, and runbooks
  5. Leading project workstreams, supporting proposals and statements of work, and contributing to practice development through reusable assets and market-facing content

Skills

Required

  • Bachelor’s degree in Computer Science, Cybersecurity, Information Security, Engineering, Information Technology, Finance, Business, or a similar field
  • 4+ years of experience developing, implementing, or architecting information systems
  • 4+ years of experience implementing Privileged Access Management or secrets management solutions in cloud environments, hybrid environments, or both
  • 4+ years of experience with at least 1 enterprise Privileged Access Management platform or secrets management platform, such as CyberArk, BeyondTrust, Delinea, HashiCorp Vault, Amazon Web Services Secrets Manager, or Azure Key Vault
  • 4+ years of experience in at least 3 of the following: automated credential rotation, application credential vaulting, service account governance, service account provisioning and deprovisioning, entitlement reviews, least-privilege access design, integration with Lightweight Directory Access Protocol or Active Directory, integration with Kubernetes, Terraform, Jenkins, or GitHub Actions, scripting in PowerShell, Python, or Bash, or automation using Representational State Transfer application programming interfaces
  • Ability to travel 25-50%, on average

Nice to have

  • 1+ year of consulting experience
  • Experience with at least 1 Non-Human Identity or machine identity platform, such as Astrix Security, Entro Security, Clutch Security, Venafi, or Teleport
  • Experience with at least 1 of the following: SPIFFE, SPIRE, workload identity federation, Istio, or Consul
  • Experience securing identities in at least 1 continuous integration, continuous delivery, or infrastructure as code environment

What the JD emphasized

  • 4+ years of experience developing, implementing, or architecting information systems
  • 4+ years of experience implementing Privileged Access Management or secrets management solutions in cloud environments, hybrid environments, or both
  • 4+ years of experience with at least 1 enterprise Privileged Access Management platform or secrets management platform, such as CyberArk, BeyondTrust, Delinea, HashiCorp Vault, Amazon Web Services Secrets Manager, or Azure Key Vault
  • 4+ years of experience in at least 3 of the following: automated credential rotation, application credential vaulting, service account governance, service account provisioning and deprovisioning, entitlement reviews, least-privilege access design, integration with Lightweight Directory Access Protocol or Active Directory, integration with Kubernetes, Terraform, Jenkins, or GitHub Actions, scripting in PowerShell, Python, or Bash, or automation using Representational State Transfer application programming interfaces