IAM/PAM Security Consultant - 100% Remote Work - German Speakers Only

Project overview

Security Consultant – IAM / PAM

Project details

100% Remote | Duration: 14 Months | On-site: 0% | German Speakers only

About the Opportunity

We are seeking an experienced Security Consultant – IAM / PAM to design and independently implement a pilot Identity, Permission, and Privileged Access Management solution for a self-operated environment, with no dependency on vendor services.

This is a 100% remote contract running from 26 October 2026 to 31 December 2027.

Key Responsibilities

Essential Experience

Apply

Submit your CV and a brief summary of relevant IAM/PAM project experience.

• Design and independently implement IAM/PAM pilot in a self-operated environment
• Architect solutions without manufacturer or third-party service dependency
• Implement directory and federation services: Kerberos, LDAP, SAML, OIDC, OAuth 2.0, SCIM
• Implement MFA without vendor dependency (hardware-bound or self-operated OTP with token lifecycle)
• Manage PAM across heterogeneous target systems, including emergency access without remote/vendor support
• Operate in-house certificate management (revocation, time sync in separated zones)
• Develop role and permission models (role mining, administration, recertification)
• Handle person, technical, and machine identities with automated delivery
• Integrate with HR processes and co-determination/works council requirements
• 6–10 years designing and introducing IAM in large, heterogeneous organizations with result responsibility
• Strong hands-on experience with self-operated directory/federation services (Kerberos, LDAP, SAML, OIDC, OAuth 2.0, SCIM)
• Proven MFA without vendor dependency and PAM across heterogeneous systems
• In-house certificate management and role/permission modeling
• Experience with HR process integration and co-determination requirements
• Practical experience with several of:
• Directory/Federation: AD, FreeIPA, UCS, Keycloak, Shibboleth, ADFS
• MFA: privacyIDEA, LinOTP, FIDO2/WebAuthn
• PAM: CyberArk, Delinea, BeyondTrust, WALLIX, Teleport, HashiCorp Boundary
• IGA: midPoint, SailPoint, One Identity, Omada
• Certificates: EJBCA, Dogtag, step-ca, ADCS, cert-manager, SPIFFE/SPIRE
• Start: ab sofort
• Duration: 14 Monate
• Remote: remote
• Location: munich, Deutschland, DE
• Languages: German