Description

Required qualifications

- [8+] years in security engineering, including [3+] years architecting identity and access management at scale.
- Deep, hands-on identity federation: enterprise identity providers, OIDC, SAML, standards-based provisioning, and mapping federated identity into downstream systems' native authorization models.
- Strong command of OAuth2/OIDC internals — scopes, audiences, token exchange, audience restriction — and common failure modes such as confused-deputy and token passthrough.
- Demonstrated implementation of an authorization policy model (RBAC plus at least one of ABAC / ReBAC) using an externalized policy engine.
- Cloud IAM depth and centralized secrets management, including automated rotation.
- Container-orchestration and container security fundamentals; able to deliver production-quality code — this role builds, not only advises.
- A track record of shipping least-privilege, just-in-time, and fully auditable access systems.

Preferred qualifications

- Securing AI agents / LLM-based systems and automated tool-invocation interfaces; prompt-injection and tool-boundary threat modeling.
- Workload identity frameworks and machine-to-machine credentialing.
- Security telemetry pipelines and SIEM integration at scale — collection, normalization, retention, and detection/correlation engineering.
- Vulnerability-management program delivery — continuous scanning, SBOM tooling, CVE correlation, and risk-based prioritization.
- Security observability on edge, IoT, or intermittently connected devices — lightweight host-based telemetry agents, store-and-forward under constrained bandwidth, and tamper-evident delivery.
- Zero-trust infrastructure access architectures; PKI, certificate lifecycle, mutual TLS, and device attestation.
- Event-driven platform security and secure CI/CD (artifact signing, infrastructure-as-code scanning, automated security gates).
- Relevant security-architecture certifications (advantageous, not required)

Key Skills

Education

Any Graduate