BeyondTrust Endpoint Privilege Management (EPM) Engineer

Responsibilities

1. Design least-privilege policies in BeyondTrust EPM (SaaS) for the 200 users, grouped by role, starting with the engineering group's complex elevation needs.
2. Use BeyondTrust reporting and audit data to identify the applications, installers, and tasks that need elevation rules.
3. Deploy and target the EPM agent and policies through Intune and Entra ID groups.
4. Run a pilot, then remove local admin rights in waves, with hypercare after each wave.
5. Route software change requests through the client's existing ServiceNow integration for Security and Software Compliance approval.
6. Document policies and runbooks and hand over to the client End User Services team
7. Report weekly on users migrated, open exceptions, and ticket trends.

Must have skills

• 5+ years of hands-on experience with BeyondTrust Endpoint Privilege Management for Windows (SaaS): Policy Editor, workstyles, application and elevation rules, user messaging, reporting
• At least five or six completed local admin rights removal at enterprise scale (hundreds of endpoints)
• Intune and Entra ID: agent deployment and group-based policy targeting.
• Windows Endpoint Administration: UAC behavior, installers and updaters, Group Policy
• Experience elevating developer and engineering tooling (IDEs, build tools, local services, admin consoles) without granting full admin rights
• ServiceNow familiarity, including integrated approval workflows
• Clear communicator with end users and directors, able to deliver against a fixed end date

Any of these is a plus.

• BeyondTrust Password Safe or the wider BeyondTrust Pathfinder platform.
• CyberArk Endpoint Privilege Manager or Delinea Privilege Manager.
• Microsoft Defender for Endpoint or Zero Trust program experience.