Identity for AI Service Architect

Atos; Bengaluru; Sur place; INR 250 000 - 420 000; Plein temps

Résumé du poste

Atos is hiring for a senior identity and access management architect focused on AI-powered, secure end-to-end digital services in Bengaluru. You will design and implement scalable IAM solutions, including agent identities, entitlement models, and policy-driven access controls across AI tools and platforms.

Key responsibilities include integrating an authorization system in production, enforcing prompt-time entitlements, and aligning models and datasets within a unified access framework.

Qualifications

• Deep IAM architecture for AI systems including authentication, authorization and governance.
• Experience designing identity services, reference architecture and platform evaluation.
• Hands-on with agent identities and lifecycle management (multiple platforms).
• Ability to align models, agents and datasets under a unified entitlement model.

Responsabilités

• Build or integrate an authorization system in production with policy engines.
• Define and enforce prompts-time entitlements across tasks and agents.
• Implement access governance using SCIM, OPA/Rego or Cedar.
• Integrate identity layers for AI gateways and token issuance flows.

Connaissances

Identity and access management

Design depth

AI agent identity lifecycle

AI access governance

Delegated authorisation

Policy as code

Model Context Protocol

Prompt-time entitlement enforcement

AI gateway deployment

Token issuance & OIDC

Non-human identity governance

OAuth 2.1 / DPoP / mTLS

Outils

Microsoft Entra Agent ID

Okta

SailPoint ISC

Saviynt

OIDC

Description du poste

Atos is the Atos Group brand dedicated to AI-powered, secure, end-to-end digital services. Atos designs, develops, and operates critical digital environments that drive performance, resilience and sovereignty, helping public and private organizations worldwide retain control over their data and infrastructures, while meeting regulatory requirements.

With more than 52,000 employees serving over 4,500 clients across 54 countries, Atos helps modernize core IT systems, accelerate cloud and data transformation, strengthen cybersecurity, and deliver secure digital workplace environments to support its clients, its employees and society. Atos also provides consulting and advisory services through its Atos Amplify brand.
A trusted partner in operating complex and mission-critical environments, Atos supports organizations across highly regulated and sovereign contexts.

Atos Group is a global leader in digital transformation with c. 54,000 employees and annual revenue of c. €7.2 billion, operating in 54 countries under two brands - Atos for services and Eviden for products and systems. European number one in cybersecurity and a leader in cloud, Atos Group is committed to a secure and decarbonized future and provides tailored AI-powered, end-to-end solutions for all industries. Atos Group is listed on Euronext Paris.

Must have skills

• Identity and access management architecture at design depth (authentication, authorisation, federation, lifecycle, governance), applied to AI systems and agents
• Architected and productised identity services (reference architecture, platform evaluation and selection, service definition), not implementation only
• AI agent identity lifecycle: registration with a human sponsor, declared scope, short-lived credential issuance, revocation; hands-on with at least one of Microsoft Entra Agent ID, Okta cross-app access, SailPoint Agent Identity Security, Cisco/Astrix
• AI access governance: bringing models, agents and datasets under the same entitlement model and access certification as applications, through SailPoint ISC or Saviynt at registry and API level, and SCIM 2.0
• Delegated authorisation at protocol depth: how a user's authority becomes an agent's authority via OAuth 2.1, token exchange (RFC 8693) and on-behalf-of flows, sender-constrained tokens (DPoP, mTLS), OIDC claims and audiences
• Built or integrated an authorisation system in production (policy engine, authorisation service or token-level IdP integration)
• Policy as code for agent scopes and tool permissions: OPA/Rego or Cedar
• Model Context Protocol and agent frameworks: where identity is asserted in a tool call, tool allow-listing, per-task isolation
• Prompt-time entitlement enforcement: RAG architecture with retrieval scoped to the asker's identity entitlements (permission filtering at retrieval, index scoping per asker)
• AI gateway / prompt control layer deployment (Microsoft Purview, Zenity, Lasso or open-source) integrated with the identity provider for the asker's token and the entitlement model for their rights
• Microsoft Entra ID or Okta at token issuance, conditional access and session level, where an agent's delegated authority originates and is revoked
• Non-human identity governance and SPIFFE/SPIRE workload identity as the source of agent credentials

Good to have

• Microsoft, Google, AWS and Anthropic agent and model platforms; sovereign model hosting (Mistral, Aleph Alpha)
• Telemetry modelling in an open schema (OCSF)
• EU AI Act human-oversight obligations; GDPR and works-council constraints on prompt inspection
• Awareness of AI security and MITRE ATLAS (prompt injection, model safety), which is adjacent to this role rather than part of it

Candidates will rarely tick every must-have, and that is expected. The ones that should not be waived are:

• the service-architecture experience on all three
• SOC fluency for ITE
• key ceremony and PKI design depth for Machine Identity, and
• the protocol-level authorisation experience and IAM architecture depth for Identity for AI

Here at Atos, diversity and inclusion are embedded in our DNA. Read more about our commitment to a fair work environment for all.

Atos is a recognized leader in its industry across Environment, Social and Governance (ESG) criteria. Find out more on our CSR commitment.