KPMG
San Francisco, California
The KPMG Advisory practice is at the forefront of transformation, offering excellent opportunities for individuals to advance their careers and expertise with KPMG. Looking ahead, we anticipate continued evolution and success within the practice, fostering both personal and professional development, thereby creating new pathways for growth. In this ever-changing market environment, our professionals must be adaptable and thrive in a collaborative, team-driven culture. At KPMG, our people are our number one priority. With a wealth of learning and career development opportunities, a world-class training facility, and leading market tools, we help our people continue to grow both professionally and personally. If you're looking for a firm with a strong team connection where you can be your whole self, have an impact, advance your skills, deepen your experiences, and have the flexibility and access to constantly find new areas of inspiration and expand your capabilities, then consider a career in Advisory. KPMG is currently seeking a Senior Associate, Privileged Access Management Delivery Engineer to join our Advisory Services practice. Responsibilities: Support the delivery, configuration, and operationalization of Privileged Access Management (PAM) solutions as part of enterprise Identity & Access Management (IAM) programs Implement and maintain PAM capabilities including privileged credential management, session management, just-in-time access, and endpoint management (EPM)components; implement automated integration across adjacent security solutions (for example: Crowdstrike, SIEM solutions, ServiceNow); automate PAM tasks using scripting and APIs (such as PowerShell, Python, REST, and others) and integrate with enterprise platforms (that is, Active Directory, IdPs, ITSM platforms, SIEM platforms, and more) Integrate PAM solutions across cloud environments (for example: Azure, AWS, GCP) while following security leading practices Execute privileged access onboarding activities, access workflow configurations, and break glass process enablement Perform risk assessments, evaluate privileged access controls, and support remediation activities across client environments Collaborate with cross-functional engineering, security, and risk teams to enhance PAM processes and resolve technical issues; support migrations from legacy or alternative PAM tooling; contribute to standardization of PAM delivery patterns and templates Act with integrity, professionalism, and personal responsibility to uphold KPMG's respectful and courteous work environment Qualifications: Minimum three years of recent professional experience in Identity & Access Management, Privileged Access Management, or cybersecurity Bachelor's degree from an accredited college or university is required; CyberArk Certified Delivery Engineer (CDE) or CyberArk Endpoint Privilege Manager (EPM) Certification preferred Hands on experience with Privileged Access Management delivery and engineering, with specific experience using CyberArk On-Prem and SaaS solutions; additional experience with secrets management platforms (that is, Conjur, HashiCorp) and other PAM platforms (such as Delinea, BeyondTrust) preferred Familiarity with infrastructure administration (such as Windows, Linux, Databases), networking basics, and IT architecture principles preferred. Experience supporting PAM integrations within cloud platforms such as Azure, AWS, or GCP; proficiency with scripting, automation integrations, infrastructure-as-code, and configuration management Strong understanding of IAM concepts, privileged access controls, and associated security risks; strong problem solving, communication, and documentation skills with the ability to work collaboratively across teams Ability to travel up to 50% Applicants must be authorized to work in the U.S. without the need for employment-based visa sponsorship now or in the future; KPMG LLP will not sponsor applicants for U.S. work visa status for this opportunity (no sponsorship is available for H-1B, L-1, TN, O-1, E-3, H-1B1, F-1, J-1, OPT, CPT or any other employment-based visa) KPMG LLP and its subsidiaries ("KPMG") complies with all local/state regulations regarding displaying salary ranges. If required, the ranges displayed below or via the URL below are specifically for those potential hires who will work in the location(s) listed. Any offered salary is determined based on relevant factors such as applicant's skills, job responsibilities, prior relevant experience, certain degrees and certifications and market considerations. In addition, KPMG is proud to offer a comprehensive, competitive benefits package, with options designed to help you make the best decisions for yourself, your family, and your lifestyle. Available benefits are based on eligibility. Our Total Rewards package includes a variety of medical and dental plans, vision coverage, disability and life insurance, 401(k) plans, and a robust suite of personal well-being benefits to support your mental health. Depending on job classification, standard work hours, and years of service, KPMG provides Personal Time Off per fiscal year. Additionally, each year KPMG publishes a calendar of holidays to be observed during the year and provides eligible employees two breaks each year where employees will not be required to use Personal Time Off; one is at year end and the other is around the July 4th holiday. Additional details about our benefits can be found towards the bottom of our KPMG US Careers site at Benefits & How We Work . Follow this link to obtain salary ranges by city outside of CA: California Salary Range: $95855 - $208265 KPMG offers a comprehensive compensation and benefits package. KPMG is an equal opportunity employer. KPMG complies with all applicable federal, state and local laws regarding recruitment and hiring. All qualified applicants are considered for employment without regard to race, color, religion, age, sex, sexual orientation, gender identity, national origin, citizenship status, disability, protected veteran status, or any other category protected by applicable federal, state or local laws. The attached link contains further information regarding KPMG's compliance with federal, state and local recruitment and hiring laws. No phone calls or agencies please. KPMG recruits on a rolling basis. Candidates are considered as they apply, until the opportunity is filled. Candidates are encouraged to apply expeditiously to any role(s) for which they are qualified that is also of interest to them. Los Angeles County applicants: Material job duties for this position are listed above. Criminal history may have a direct, adverse, and negative relationship with some of the material job duties of this position. These include the duties and responsibilities listed above, as well as the abilities to adhere to company policies, exercise sound judgment, effectively manage stress and work safely and respectfully with others, exhibit trustworthiness, and safeguard business operations and company reputation. Pursuant to the California Fair Chance Act, Los Angeles County Fair Chance Ordinance for Employers, Fair Chance Initiative for Hiring Ordinance, and San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.
The KPMG Advisory practice is at the forefront of transformation, offering excellent opportunities for individuals to advance their careers and expertise with KPMG. Looking ahead, we anticipate continued evolution and success within the practice, fostering both personal and professional development, thereby creating new pathways for growth. In this ever-changing market environment, our professionals must be adaptable and thrive in a collaborative, team-driven culture. At KPMG, our people are our number one priority. With a wealth of learning and career development opportunities, a world-class training facility, and leading market tools, we help our people continue to grow both professionally and personally. If you're looking for a firm with a strong team connection where you can be your whole self, have an impact, advance your skills, deepen your experiences, and have the flexibility and access to constantly find new areas of inspiration and expand your capabilities, then consider a career in Advisory. KPMG is currently seeking a Senior Associate, Privileged Access Management Delivery Engineer to join our Advisory Services practice. Responsibilities: Support the delivery, configuration, and operationalization of Privileged Access Management (PAM) solutions as part of enterprise Identity & Access Management (IAM) programs Implement and maintain PAM capabilities including privileged credential management, session management, just-in-time access, and endpoint management (EPM)components; implement automated integration across adjacent security solutions (for example: Crowdstrike, SIEM solutions, ServiceNow); automate PAM tasks using scripting and APIs (such as PowerShell, Python, REST, and others) and integrate with enterprise platforms (that is, Active Directory, IdPs, ITSM platforms, SIEM platforms, and more) Integrate PAM solutions across cloud environments (for example: Azure, AWS, GCP) while following security leading practices Execute privileged access onboarding activities, access workflow configurations, and break glass process enablement Perform risk assessments, evaluate privileged access controls, and support remediation activities across client environments Collaborate with cross-functional engineering, security, and risk teams to enhance PAM processes and resolve technical issues; support migrations from legacy or alternative PAM tooling; contribute to standardization of PAM delivery patterns and templates Act with integrity, professionalism, and personal responsibility to uphold KPMG's respectful and courteous work environment Qualifications: Minimum three years of recent professional experience in Identity & Access Management, Privileged Access Management, or cybersecurity Bachelor's degree from an accredited college or university is required; CyberArk Certified Delivery Engineer (CDE) or CyberArk Endpoint Privilege Manager (EPM) Certification preferred Hands on experience with Privileged Access Management delivery and engineering, with specific experience using CyberArk On-Prem and SaaS solutions; additional experience with secrets management platforms (that is, Conjur, HashiCorp) and other PAM platforms (such as Delinea, BeyondTrust) preferred Familiarity with infrastructure administration (such as Windows, Linux, Databases), networking basics, and IT architecture principles preferred. Experience supporting PAM integrations within cloud platforms such as Azure, AWS, or GCP; proficiency with scripting, automation integrations, infrastructure-as-code, and configuration management Strong understanding of IAM concepts, privileged access controls, and associated security risks; strong problem solving, communication, and documentation skills with the ability to work collaboratively across teams Ability to travel up to 50% Applicants must be authorized to work in the U.S. without the need for employment-based visa sponsorship now or in the future; KPMG LLP will not sponsor applicants for U.S. work visa status for this opportunity (no sponsorship is available for H-1B, L-1, TN, O-1, E-3, H-1B1, F-1, J-1, OPT, CPT or any other employment-based visa) KPMG LLP and its subsidiaries ("KPMG") complies with all local/state regulations regarding displaying salary ranges. If required, the ranges displayed below or via the URL below are specifically for those potential hires who will work in the location(s) listed. Any offered salary is determined based on relevant factors such as applicant's skills, job responsibilities, prior relevant experience, certain degrees and certifications and market considerations. In addition, KPMG is proud to offer a comprehensive, competitive benefits package, with options designed to help you make the best decisions for yourself, your family, and your lifestyle. Available benefits are based on eligibility. Our Total Rewards package includes a variety of medical and dental plans, vision coverage, disability and life insurance, 401(k) plans, and a robust suite of personal well-being benefits to support your mental health. Depending on job classification, standard work hours, and years of service, KPMG provides Personal Time Off per fiscal year. Additionally, each year KPMG publishes a calendar of holidays to be observed during the year and provides eligible employees two breaks each year where employees will not be required to use Personal Time Off; one is at year end and the other is around the July 4th holiday. Additional details about our benefits can be found towards the bottom of our KPMG US Careers site at Benefits & How We Work . Follow this link to obtain salary ranges by city outside of CA: California Salary Range: $95855 - $208265 KPMG offers a comprehensive compensation and benefits package. KPMG is an equal opportunity employer. KPMG complies with all applicable federal, state and local laws regarding recruitment and hiring. All qualified applicants are considered for employment without regard to race, color, religion, age, sex, sexual orientation, gender identity, national origin, citizenship status, disability, protected veteran status, or any other category protected by applicable federal, state or local laws. The attached link contains further information regarding KPMG's compliance with federal, state and local recruitment and hiring laws. No phone calls or agencies please. KPMG recruits on a rolling basis. Candidates are considered as they apply, until the opportunity is filled. Candidates are encouraged to apply expeditiously to any role(s) for which they are qualified that is also of interest to them. Los Angeles County applicants: Material job duties for this position are listed above. Criminal history may have a direct, adverse, and negative relationship with some of the material job duties of this position. These include the duties and responsibilities listed above, as well as the abilities to adhere to company policies, exercise sound judgment, effectively manage stress and work safely and respectfully with others, exhibit trustworthiness, and safeguard business operations and company reputation. Pursuant to the California Fair Chance Act, Los Angeles County Fair Chance Ordinance for Employers, Fair Chance Initiative for Hiring Ordinance, and San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.
Kaiser Permanente
Greensboro, North Carolina
Tech Summary The IS Consultant IV, Application Security position is a senior hands-on technical role responsible for leading complex application security assessments and advancing secure software development practices across the organization. The consultant will conduct secure code reviews, static and dynamic application security testing, open source component analysis, API and mobile application security assessments, threat modeling, security architecture reviews, vulnerability validation, and remediation guidance. The ideal candidate has advanced software development and application security experience using Java, Python, JavaScript, .NET, Swift, or similar technologies. The candidate should have practical experience with application security testing solutions, penetration testing tools such as Burp Suite or OWASP ZAP, and integrating security controls into CI/CD pipelines. This role requires the ability to independently lead complex assessments, define secure development standards and guardrails, evaluate third party applications, and influence architecture and engineering decisions. The consultant will collaborate with developers, architects, product owners, vendors, security leaders, and executive stakeholders to communicate technical risk clearly and provide actionable remediation recommendations. Experience with cloud native applications, APIs, mobile applications, AI enabled applications, DevSecOps automation, and healthcare or other regulated environments is preferred. Job Summary: In addition to responsibilities listed below, this position is responsible for reviewing application source code for potential security vulnerabilities by performing manual and automated security testing on applications in a running state (DAST); working with DevOps teams to integrate application security services; training DevOps personnel and developers to use application security tools; working one-on-one with developers to help them understand security vulnerabilities at hand and to identify/suggest remediation plans; and recommending application security training paths. This also includes responsibility for protecting applications in production by enrolling them for continuous assessment of existing and emerging threats, evaluating web application firewalls; tuning WAF rules; reviewing alerts; and identifying issues as appropriate. Essential Responsibilities: Completes work assignments and supports business-specific projects by applying expertise in subject area; supporting the development of work plans to meet business priorities and deadlines; ensuring team follows all procedures and policies; coordinating and assigning resources to accomplish priorities and deadlines; collaborating cross-functionally to make effective business decisions; solving complex problems; escalating high priority issues or risks, as appropriate; and recognizing and capitalizing on improvement opportunities. Practices self-development and promotes learning in others by proactively providing information, resources, advice, and expertise with coworkers and customers; building relationships with cross-functional stakeholders; influencing others through technical explanations and examples; adapting to competing demands and new responsibilities; listening and responding to, seeking, and addressing performance feedback; providing feedback to others and managers; creating and executing plans to capitalize on strengths and develop weaknesses; supporting team collaboration; and adapting to and learning from change, difficulties, and feedback. Effectively communicates investigative findings to non-technical audiences. Collaborates with technology risk teams and business stakeholders to respond to and remediate identified issues, and determine the best approach for improving security posture. Provides recommendations to management and business stakeholders on how to remediate issues identified through security testing processes. Identifies the impact of security test plans on upstream and downstream solution components. Supports information sharing and integration procedures across cyber security through the exchange of threat intelligence and cyber security vulnerability assessment data. Contributes to cyber security intellectual capital by making process or procedure improvements, conducting brown bag training sessions, and creating new training documents. Follows established processes to ensure KPI goals are obtained and performance metrics are tracked on an ongoing basis. Recommends business line or business technology team security process improvements which align with sustainable best practices, and the strategic and tactical goals of the business. Supports continuous process improvement by participating in the development, implementation, and maintenance of standardized security tools, templates, and processes across multiple business domains. Performs complex security test data analysis in support of security vulnerability assessment processes, including root cause analysis. Serves as an escalation point on issues, dependencies, and risks related to security testing. Executes the vulnerability assessment and penetration testing plan, methodologies, and standard processes for moderately to highly complex technology initiatives across multiple IT domains by analyzing business and technology requirements. Researches and stays abreast of industry trends, emerging threats, best practices, and cutting edge techniques to creatively discover and exploit vulnerabilities, and recommend security solutions for technology systems. Provides insight and consultation on the development of testing scope and approach, and collaborates with cross-functional IT and business stakeholders to review the overall testing approach. Validates security test scenarios across various SDLC phases (e.g., development, reproduction, production) for low- to moderately-complex projects. Generates scheduled reports (e.g., status updates, risk assessment reports, remediation reports) and provides regular security metrics to IT teams and management as appropriate. Minimum Qualifications: Minimum three (3) years software or application development experience. Minimum one (1) year experience in application security (e.g., source code analysis, dynamic analysis, etc.). Bachelors degree in Business Administration, Computer Science, Social Science, Mathematics, or related field and Minimum six (6) years experience in IT or a related field, including Minimum two (2) years in information security, network engineering, or application development. Additional equivalent work experience may be substituted for the degree requirement. Additional Requirements:
Tech Summary The IS Consultant IV, Application Security position is a senior hands-on technical role responsible for leading complex application security assessments and advancing secure software development practices across the organization. The consultant will conduct secure code reviews, static and dynamic application security testing, open source component analysis, API and mobile application security assessments, threat modeling, security architecture reviews, vulnerability validation, and remediation guidance. The ideal candidate has advanced software development and application security experience using Java, Python, JavaScript, .NET, Swift, or similar technologies. The candidate should have practical experience with application security testing solutions, penetration testing tools such as Burp Suite or OWASP ZAP, and integrating security controls into CI/CD pipelines. This role requires the ability to independently lead complex assessments, define secure development standards and guardrails, evaluate third party applications, and influence architecture and engineering decisions. The consultant will collaborate with developers, architects, product owners, vendors, security leaders, and executive stakeholders to communicate technical risk clearly and provide actionable remediation recommendations. Experience with cloud native applications, APIs, mobile applications, AI enabled applications, DevSecOps automation, and healthcare or other regulated environments is preferred. Job Summary: In addition to responsibilities listed below, this position is responsible for reviewing application source code for potential security vulnerabilities by performing manual and automated security testing on applications in a running state (DAST); working with DevOps teams to integrate application security services; training DevOps personnel and developers to use application security tools; working one-on-one with developers to help them understand security vulnerabilities at hand and to identify/suggest remediation plans; and recommending application security training paths. This also includes responsibility for protecting applications in production by enrolling them for continuous assessment of existing and emerging threats, evaluating web application firewalls; tuning WAF rules; reviewing alerts; and identifying issues as appropriate. Essential Responsibilities: Completes work assignments and supports business-specific projects by applying expertise in subject area; supporting the development of work plans to meet business priorities and deadlines; ensuring team follows all procedures and policies; coordinating and assigning resources to accomplish priorities and deadlines; collaborating cross-functionally to make effective business decisions; solving complex problems; escalating high priority issues or risks, as appropriate; and recognizing and capitalizing on improvement opportunities. Practices self-development and promotes learning in others by proactively providing information, resources, advice, and expertise with coworkers and customers; building relationships with cross-functional stakeholders; influencing others through technical explanations and examples; adapting to competing demands and new responsibilities; listening and responding to, seeking, and addressing performance feedback; providing feedback to others and managers; creating and executing plans to capitalize on strengths and develop weaknesses; supporting team collaboration; and adapting to and learning from change, difficulties, and feedback. Effectively communicates investigative findings to non-technical audiences. Collaborates with technology risk teams and business stakeholders to respond to and remediate identified issues, and determine the best approach for improving security posture. Provides recommendations to management and business stakeholders on how to remediate issues identified through security testing processes. Identifies the impact of security test plans on upstream and downstream solution components. Supports information sharing and integration procedures across cyber security through the exchange of threat intelligence and cyber security vulnerability assessment data. Contributes to cyber security intellectual capital by making process or procedure improvements, conducting brown bag training sessions, and creating new training documents. Follows established processes to ensure KPI goals are obtained and performance metrics are tracked on an ongoing basis. Recommends business line or business technology team security process improvements which align with sustainable best practices, and the strategic and tactical goals of the business. Supports continuous process improvement by participating in the development, implementation, and maintenance of standardized security tools, templates, and processes across multiple business domains. Performs complex security test data analysis in support of security vulnerability assessment processes, including root cause analysis. Serves as an escalation point on issues, dependencies, and risks related to security testing. Executes the vulnerability assessment and penetration testing plan, methodologies, and standard processes for moderately to highly complex technology initiatives across multiple IT domains by analyzing business and technology requirements. Researches and stays abreast of industry trends, emerging threats, best practices, and cutting edge techniques to creatively discover and exploit vulnerabilities, and recommend security solutions for technology systems. Provides insight and consultation on the development of testing scope and approach, and collaborates with cross-functional IT and business stakeholders to review the overall testing approach. Validates security test scenarios across various SDLC phases (e.g., development, reproduction, production) for low- to moderately-complex projects. Generates scheduled reports (e.g., status updates, risk assessment reports, remediation reports) and provides regular security metrics to IT teams and management as appropriate. Minimum Qualifications: Minimum three (3) years software or application development experience. Minimum one (1) year experience in application security (e.g., source code analysis, dynamic analysis, etc.). Bachelors degree in Business Administration, Computer Science, Social Science, Mathematics, or related field and Minimum six (6) years experience in IT or a related field, including Minimum two (2) years in information security, network engineering, or application development. Additional equivalent work experience may be substituted for the degree requirement. Additional Requirements:
