BeyondTrust Endpoint Privilege Management (EPM) Engineer

Responsibilities

• Design least-privilege policies in BeyondTrust EPM (SaaS) for the 200 users, grouped by role, starting with the engineering group's complex elevation needs.
• Use BeyondTrust reporting and audit data to identify the applications, installers, and tasks that need elevation rules.
• Deploy and target the EPM agent and policies through Intune and Entra ID groups.
• Run a pilot, then remove local admin rights in waves, with hypercare after each wave.
• Route software change requests through the client's existing ServiceNow integration for Security and Software Compliance approval.
• Document policies and runbooks and hand over to the client End User Services team
• Report weekly on users migrated, open exceptions, and ticket trends.

Must have skills

• 5+ years of hands-on experience with BeyondTrust Endpoint Privilege Management for Windows (SaaS): Policy Editor, workstyles, application and elevation rules, user messaging, reporting
• At least five or six completed local admin rights removal at enterprise scale (hundreds of endpoints)
• Intune and Entra ID: agent deployment and group-based policy targeting.
• Windows Endpoint Administration: UAC behavior, installers and updaters, Group Policy
• Experience elevating developer and engineering tooling (IDEs, build tools, local services, admin consoles) without granting full admin rights
• ServiceNow familiarity, including integrated approval workflows
• Clear communicator with end users and directors, able to deliver against a fixed end date

Any of these is a plus.

• BeyondTrust Password Safe or the wider BeyondTrust Pathfinder platform.
• CyberArk Endpoint Privilege Manager or Delinea Privilege Manager.
• Microsoft Defender for Endpoint or Zero Trust program experience.