Senior Staff Machine Identity and PKI Engineer

Description

Every service account, workload, certificate, token and AI agent should have its own identity, a named owner, and only the access it actually needs, with credentials that expire and renew on their own.

The company builds AI infrastructure and is scaling fast. You will be the team's most senior specialist in machine identity and PKI, owning hard-to-reverse decisions from certificate authority design through to post-quantum planning, and setting technical standards for SRE, platform and product.

Responsibilities

• Create a register of non-human identities covering cloud service accounts, CI credentials, API keys, tokens, certificates and agent identities, each with an owner, scope and rotation date.
• Replace static, long-lived credentials with short-lived workload identity using GitHub Actions OIDC, cloud workload identity federation, Kubernetes service account tokens and, where suitable, SPIFFE/SPIRE.
• Own the company's PKI and lead the rollout of a certificate lifecycle management platform. The selection is already in progress.
• Automate certificate issuance and renewal with ACME, cert-manager and EST/SCEP, and set up device certificates for managed endpoints.
• Define the machine secrets standard and agree with SRE, who run HashiCorp Vault, how workloads authenticate to it and use its PKI.
• Design how AI agents and tool integrations receive their own identity, a human owner, scoped access and a kill switch that is tested.
• Plan the move of the certificate estate to post-quantum cryptography.

Requirements

• 10+ years in platform engineering, infrastructure security or SRE, with deep work on workload identity, secrets and PKI, including designing CA hierarchies and leading standards that several teams have adopted.
• Hands-on PKI work covering CA hierarchy design, certificate profiles, revocation and HSMs, plus experience with a certificate lifecycle platform such as Keyfactor, Entrust, AppViewX or DigiCert.
• Production use of HashiCorp Vault, including auth methods, dynamic secrets and the PKI engine.
• Experience with cloud workload identity and OIDC federation from CI, plus Kubernetes service accounts and RBAC.
• Preferred: GCP experience.
• Ability to write code in Go or Python and to work with Terraform.

Conditions

The base salary range is $190,000 - $260,000 USD. Actual pay depends on factors such as skill set, experience, education and location.

The role may also be eligible for bonus, equity and/or commission. Overall US compensation (base, bonus and equity) is competitive, with performance reviews every 12 months.

The workplace is flexible and trusts staff to deliver, giving you autonomy over your working day.

The company does not accept unsolicited submissions from recruitment agencies.

The company strongly encourages applications from people of colour, LGBTQ+ people, people with disabilities, neurodivergent people, parents, carers and people from lower socio-economic backgrounds, and will make accommodations on request. You may be asked to take on other duties suited to your skills and qualifications.

Benefits

• The company may offer a benefits package including medical, dental and vision cover, flexible paid time off, parental leave and retirement plan participation.
• A progression plan shaped around your goals, with the chance to lead cross-functional initiatives and help shape capital strategy.