12c equivalent of expdp '/ as sysdba'

We have some cron job scripts to run

expdp \'/ as sysdba\' ...

sqlplus \'/ as sysdba\' ...

in 11g. We just installed a 12cR2 database and want to set up the same job. The new database uses the multi-tenant architecture with only one PDB. (We'll never have more than one PDB and will not use the traditional non-multitenant architecture.) The user's data is in the PDB. What's the common practice to export data from the PDB, ideally without providing a password and as sys?

We can simply change the code to

expdp \'sys/password@connectidentifier as sysdba\' ...

which exposes the password in the script.