PAM Senior Specialist

JOB PURPOSE: Operates and continuously improves Misk Foundation's Identity and Access Management (IAM) and Privileged Access Management (PAM) platforms. Ensures identities, entitlements, and privileged credentials are provisioned, governed, and deprovisioned in line with least privilege, need-to-know, and NCA ECC-2 / PDPL obligations. Serves as technical authority on IAM and PAM controls. KEY RESPONSIBILITIES & ACCOUNTABILITIES: Privileged Access Management: • Operates the PAM platform: vaulting, session recording, JIT elevation, password rotation. • Onboards privileged accounts to PAM within SLAs; remediates out-of-PAM privileged accounts. • Maintains break-glass accounts: sealed offline vault, split knowledge, quarterly rotation, and Sev 1 alerting on use. • Reviews privileged access requests against least-privilege criteria. Access Review & Governance: • Executes quarterly access review (standard, service, shared, M365 guest, federated); monthly for privileged. • Drives remediation of dormant, excessive, or orphaned access with line managers. • Produces audit evidence for NCA, PDPL, and internal audit. Incident & Change Support: • Supports identity-compromise incidents: containment, session revocation, credential reset, evidence preservation under MF-DT-PRC-004. • Provides Cybersecurity Review input for IAM/PAM-impacting changes under MF-DT-PRC-006. Continuous Improvement: • Maintains IAM/PAM runbooks, SOPs, and architecture documentation. • Proposes hardening against credential theft, MFA fatigue, and session hijacking. QUALIFICATIONS, EXPERIENCE & SKILLS: • Bachelor's in CS, Information Security, or related. • SC-300, CyberArk CDE/Defender, BeyondTrust Certified, Okta, SailPoint, or CISSP. • Minimum 1-2 years hands-on IAM and/or PAM operations. • Operated one enterprise PAM (CyberArk, BeyondTrust, Delinea) and one IAM/IGA (SailPoint, Saviynt, Entra ID Governance). • NCA ECC / PDPL audit support preferred. • AD, Entra ID, M365 identity, federation (SAML, OIDC, OAuth 2.0). • PAM concepts: vaulting, session management, JIT, zero standing privilege. • PowerShell and Graph API automation. • Identity attack paths: Kerberoasting, pass-the-hash, token theft, consent phishing. • Detail-oriented; strong documentation discipline. • Balances security rigor with user experience. Arabic preferred. KEY INTERNAL & EXTERNAL INTERACTIONS: Internal • Head of Cyber Defense & Operations (line manager) • Digital Platform & Infrastructure, DT Support, HR, system owners • Internal Audit, Risk & Compliance, Legal External • PAM and IAM/IGA vendors and partners • Microsoft and identity provider support • External auditors (NCA, PDPL, ISO 27001)

Bachelor's in CS, Information Security, or related. SC-300, CyberArk CDE/Defender, BeyondTrust Certified, Okta, SailPoint, or CISSP. Minimum 1-2 years hands-on IAM and/or PAM operations. Operated one enterprise PAM (CyberArk, BeyondTrust, Delinea) and one IAM/IGA (SailPoint, Saviynt, Entra ID Governance). NCA ECC / PDPL audit support preferred. AD, Entra ID, M365 identity, federation (SAML, OIDC, OAuth 2.0). PAM concepts: vaulting, session management, JIT, zero standing privilege. PowerShell and Graph API automation. Identity attack paths: Kerberoasting, pass-the-hash, token theft, consent phishing. Detail-oriented; strong documentation discipline. Balances security rigor with user experience. Arabic preferred.

Privileged Access Management: Operates the PAM platform: vaulting, session recording, JIT elevation, password rotation. Onboards privileged accounts to PAM within SLAs; remediates out-of-PAM privileged accounts. Maintains break-glass accounts: sealed offline vault, split knowledge, quarterly rotation, and Sev 1 alerting on use. Reviews privileged access requests against least-privilege criteria. Access Review & Governance: Executes quarterly access review (standard, service, shared, M365 guest, federated); monthly for privileged. Drives remediation of dormant, excessive, or orphaned access with line managers. Produces audit evidence for NCA, PDPL, and internal audit. Incident & Change Support: Supports identity-compromise incidents: containment, session revocation, credential reset, evidence preservation under MF-DT-PRC-004. Provides Cybersecurity Review input for IAM/PAM-impacting changes under MF-DT-PRC-006. Continuous Improvement: Maintains IAM/PAM runbooks, SOPs, and architecture documentation. Proposes hardening against credential theft, MFA fatigue, and session hijacking.