{"id":87062,"url":"https://alion.io/job/roche-cybersecurity-analyst-privileged-access-management","title":"Cybersecurity Analyst - Privileged Access Management","company":{"id":13531,"name":"Roche","domain":"roche.com","url":"https://alion.io/company/roche","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":86,"open_postings":244,"ghost_share":0.045,"stale_share":0.561,"repost_share":0.123,"time_to_fill_p50_days":20,"computed_at":"2026-11-08T05:47:12Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Petaling Jaya, Malaysia"],"countries":["MY"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Ansible","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"Docker","optional":false},{"name":"GCP","optional":false},{"name":"HashiCorp Vault","optional":false},{"name":"Kubernetes","optional":false},{"name":"LDAP","optional":false},{"name":"PKI","optional":false},{"name":"Platform Engineering","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Vault","optional":false},{"name":"CyberArk","optional":true},{"name":"GitHub Actions","optional":true},{"name":"GitLab CI","optional":true},{"name":"ITIL","optional":true},{"name":"Jenkins","optional":true},{"name":"Terraform","optional":true}],"status":"live","first_seen_at":"2026-08-20T00:00:00Z","employer_posted_date":"2026-10-30","last_verified_at":"2026-11-08T13:50:18Z","board_verified":true,"closed_at":null,"days_open":80,"trust":{"level":"ok","repost_count":1,"flags":[],"days_open":80},"description":"At Roche you can show up as yourself, embraced for the unique qualities you bring. Our culture encourages personal expression, open dialogue, and genuine connections, where you are valued, accepted and respected for who you are, allowing you to thrive both personally and professionally. This is how we aim to prevent, stop and cure diseases and ensure everyone has access to healthcare today and for generations to come. Join Roche, where every voice matters.\nThe Position\nIn a world where every application, pipeline, and cloud workload depends on secure access, the people who build and manage that trust layer are critical. At Roche, our Enterprise Privileged Access Management team is responsible for exactly that - ensuring the right systems and people have the right access, at the right time, with the right controls in place. If you enjoy working on platforms that matter, thrive in a complex global environment, and want to deepen your expertise in one of the most in-demand areas of enterprise security - this is the role for you.\nYour Opportunity\nAs a Cybersecurity Analyst specialising in PAM, HashiCorp Vault, and PKI, you will be a core member of a global security team working at the intersection of platform engineering and cybersecurity. You will own meaningful workstreams, partner with product owners and application teams, and serve as the Tier 3 expert when complex PAM and Vault issues need to be resolved. This is not a monitoring-and-ticket role - you will be expected to design, build, and continuously improve.\nIn this role, you will:\nDrive HashiCorp Vault platform delivery in partnership with the product owner - leading initiatives to upgrade and automate privileged access controls across the enterprise\n\nDesign and deploy automation scripts and integrations (PowerShell, Python, Ansible) to streamline Vault operations and reduce manual effort\n\nBuild self-service portals and APIs that make secret usage effortless for application teams, embedding DevSecOps principles into access processes\n\nIntegrate secrets management into CI/CD pipelines and IaC toolchains across major cloud platforms (AWS, Azure, GCP)\n\nMonitor, maintain, and evolve PKI infrastructure including certificate lifecycle management via platforms such as Keyfactor and RedHat IDM\n\nImplement certificate automation standards such as ACME for internal issuance and integrate PKI workflows into deployment pipelines\n\nSecure containerised environments (Docker, Kubernetes) through mutual TLS implementation\n\nAct as the Tier 3 escalation point for complex PAM and HashiCorp Vault issues - providing advanced troubleshooting, guidance, and architectural direction\n\nWho you are\nYou hold a Bachelor's Degree in Computer Science, Engineering, or a related discipline - or bring equivalent experience that demonstrates the same depth of knowledge.\nYou have 3-5 years of hands-on experience in cybersecurity or identity and access management, ideally within a large, global, or regulated organisation. You work well independently, take ownership of your deliverables, and have a track record of not just maintaining security systems - but actively improving them.\nYour technical background includes:\nHashiCorp Vault - you have configured and administered Vault in a team environment, with practical experience across secrets engines (KV, PKI, Database, cloud), auth methods (AppRole, Kubernetes, LDAP, JWT/OIDC), and policy management; experience with Vault Agent or Kubernetes sidecar injection is a plus\n\nPKI and certificate lifecycle management - you understand CA hierarchy, certificate issuance and renewal, and have worked with platforms such as Keyfactor, RedHat IDM, or Microsoft ADCS; familiarity with ACME-based automation for internal certificate issuance is advantageous\n\nSecrets management automation - you have written scripts and integrations using Python, PowerShell, or Ansible to streamline security operations and reduce manual effort\n\nCI/CD and Infrastructure-as-Code - you are comfortable working within DevOps toolchains (Terraform, Jenkins, GitLab CI/CD, or GitHub Actions) and have experience integrating secrets management or PKI workflows into deployment pipelines across AWS, Azure, or GCP\n\nNetwork and protocol fundamentals - you have a solid working knowledge of SSL/TLS, cryptography, key exchanges, cipher suites, and trust validation, and can apply this when troubleshooting complex security workflows\n\nCyberArk - working knowledge of CyberArk alongside HashiCorp Vault is an advantage, as the team operates across both platforms\n\nBeyond the technical skills, you bring:\nA clear, confident communication style - you can explain a complex security concept to a developer, a cloud engineer, and a business stakeholder in three different ways without losing accuracy\n\nA continuous improvement mindset - you proactively spot gaps, inefficiencies, and risks rather than waiting to be asked\n\nComfort with ambiguity and change in a large, matrixed organisation\n\nFamiliarity with ITIL principles (Incident, Problem, Change, Request Management) is a plus, particularly for those with experience in validated or regulated environments\n\nWho we are\nA healthier future drives us to innovate. Together, more than 100’000 employees across the globe are dedicated to advance science, ensuring everyone has access to healthcare today and for generations to come. Our efforts result in more than 26 million people treated with our medicines and over 30 billion tests conducted using our Diagnostics products. We empower each other to explore new possibilities, foster creativity, and keep our ambitions high, so we can deliver life-changing healthcare solutions that make a global impact.\nLet’s build a healthier future, together.\nRoche is an Equal Opportunity Employer.","description_format":"text","description_chars":5773,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Identity Management","Information Security","Biologics & Biosimilars"],"lifecycle":[{"event":"open","at":"2026-08-20T00:00:00Z"},{"event":"close","at":"2026-08-29T11:54:15Z"},{"event":"reopen","at":"2026-10-30T03:01:49Z"}],"visa":[],"liveness":{"score":8,"band":"cold","label":"Long shot","p_open":1,"p_active":0.29,"p_room":0.28,"age_days":80,"expected_fill_days":20,"reasons":["conf:2","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-11-08T05:47:12Z"},"pay":null,"html_url":"https://alion.io/job/roche-cybersecurity-analyst-privileged-access-management","json_url":"https://alion.io/job/roche-cybersecurity-analyst-privileged-access-management.json","meta":{"generated_at":"2026-11-08T16:49:10Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":35375,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-09T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":13531},"rest":"https://alion.io/mcp/rest/get_company?id=13531"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Froche-cybersecurity-analyst-privileged-access-management"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Froche-cybersecurity-analyst-privileged-access-management"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Froche-cybersecurity-analyst-privileged-access-management"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/roche-cybersecurity-analyst-privileged-access-management\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Froche-cybersecurity-analyst-privileged-access-management"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":87062}},{"tool":"search_jobs","arguments":{"company":"roche.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":87062},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}