Senior Staff Engineer (Devops)

Nagarro; Gurugram District; On-site; INR 4,000,000 - 7,000,000; Full time

Job summary

Nagarro in Gurugram, India, seeks an experienced IAM and secrets management expert to lead enterprise security transformations across Azure, AWS, and on‑prem environments. You will architect workload identity, PAM, credential rotation, and RBAC/ABAC controls while guiding teams across borders.

The role emphasizes DevSecOps, CI/CD integration, and governance, with a focus on secure engineering patterns, dashboards, and risk reduction.

Qualifications

• Experience 7.5+ years in security, IAM, or DevSecOps roles.
• Hands-on with enterprise cloud and security environments (Azure, AWS).
• Expertise in IAM, RBAC, ABAC, and least privilege design.
• Experience with Azure Entra ID, Managed Identity, Service Principals.
• Experience with two or more secrets management technologies.
• Knowledge of Kubernetes security, workload identity, and service accounts.
• Ability to define standards, target-state architecture, and migration plans.
• Strong stakeholder management across security, cloud, and audit teams.
• Experience in regulated industries (finance, healthcare, etc.).

Responsibilities

• Assess current enterprise secrets management and IAM practices across cloud and on‑prem.
• Define target‑state architecture for secrets management and IAM integration.
• Establish enterprise standards for storage, rotation, naming, tagging, and decommissioning.
• Define use cases for centralized secrets platforms vs cloud-native services.
• Design IAM access models using Entra ID, AWS IAM, RBAC/ABAC, and OIDC federation.
• Implement least‑privilege access across cloud, infrastructure, and workloads.
• Support onboarding and migration of teams to secure secrets/IAM practices.
• Integrate secrets management with CI/CD, Kubernetes, databases, and APIs.
• Design governance processes for ownership, access reviews, and exception handling.
• Develop reference architectures and onboarding playbooks; document standards.
• Collaborate with security, cloud, platform, and audit teams to drive security initiatives.
• Lead IAM and secrets transformation across hybrid/multi‑cloud environments.
• Define migration roadmaps and adoption plans for IAM capabilities.
• Establish dashboards and metrics for compliance and risk reduction.
• Promote DevSecOps and secure‑by‑design principles across teams.

Skills

DevSecOps

IAM

Kubernetes

RBAC/ABAC

Azure Entra ID

AWS IAM

Secrets management

CI/CD integration

Security governance

PAM

Education

Bachelor's or Master's in CS/IT

Tools

Terraform

HashiCorp Vault Enterprise

CyberArk PAM

Azure Key Vault

AWS Secrets Manager

Secrets Store CSI Driver

Gitleaks

GitHub Advanced Security

Job description

We're Nagarro. We are a Digital Product Engineering company that is scaling in a big way! We build products, services, and experiences that inspire, excite, and delight. We work at a scale — across all devices and digital mediums, and our people exist everywhere in the world (18500+ experts across 39 countries, to be exact). Our work culture is dynamic and non-hierarchical. We are looking for great new colleagues. That is where you come in!

Company Description

We're Nagarro. We are a Digital Product Engineering company that is scaling in a big way! We build products, services, and experiences that inspire, excite, and delight. We work at a scale — across all devices and digital mediums, and our people exist everywhere in the world (18500+ experts across 39 countries, to be exact). Our work culture is dynamic and non-hierarchical. We are looking for great new colleagues. That is where you come in!

Requirements

Job Description

• Experience : 7.5+ years
• Strong experience in DevOps and AWS, with hands-on exposure to enterprise cloud and security environments.
• Strong expertise in enterprise secrets management and end-to-end IAM.
• Strong knowledge of Azure Entra ID, RBAC, ABAC, and CyberArk.
• Proven experience delivering at least one enterprise transformation involving secrets management, IAM, PAM, DevSecOps, cloud security, or machine identity.
• Strong understanding of authentication, authorization, RBAC, ABAC, least privilege, federation, workload identity, privileged access, service accounts, access reviews, and audit controls.
• Hands-on experience with Azure IAM services, including Entra ID, Azure Managed Identity, and Service Principals.
• Hands-on experience with AWS IAM, including IAM roles, policies, STS, and OIDC federation.
• Experience with at least two enterprise secrets management technologies such as Azure Key Vault, AWS Secrets Manager, HashiCorp Vault, CyberArk Conjur, Akeyless, Thales CipherTrust, External Secrets Operator, or Secrets Store CSI Driver.
• Strong experience working across hybrid environments spanning cloud and on-premises workloads.
• Experience integrating secrets management and IAM controls with CI/CD platforms such as Azure DevOps, GitHub Actions, Jenkins, or GitLab.
• Experience with Kubernetes security, workload identity, service accounts, and secrets management.
• Ability to define enterprise standards, target-state architecture, migration plans, governance models, and practical engineering patterns.
• Strong stakeholder management skills across security, cloud, platform, infrastructure, application, risk, compliance, and audit teams.
• Experience working in regulated enterprise environments such as financial services, banking, insurance, healthcare, or similar industries.
• Experience with CyberArk PAM, HashiCorp Vault Enterprise, machine identity, certificate lifecycle management, or dynamic secrets.
• Experience with policy-as-code and security automation tools such as Terraform, Azure Policy, AWS Organizations/SCPs, OPA, Sentinel, Checkov, Prisma Cloud, or Wiz.
• Experience with secret scanning and remediation tools such as GitHub Advanced Security, GitGuardian, Gitleaks, or TruffleHog.
• Experience defining security dashboards and metrics for secrets compliance, IAM access hygiene, credential rotation, onboarding progress, exceptions, and risk reduction.
• Strong understanding of multi-cloud secrets management and IAM processes.
• Strong analytical, problem-solving, communication, and technical documentation skills.
• Ability to work effectively with geographically distributed engineering and security teams.

Responsibilities

• Assess current enterprise secrets management and IAM practices across Azure, AWS, on-premises platforms, Kubernetes, CI/CD pipelines, applications, databases, APIs, and service accounts.
• Define target-state architecture for enterprise secrets management, IAM integration, workload identity, privileged access, credential rotation, auditing, and governance.
• Establish enterprise standards for secrets storage, access, rotation, ownership, naming, tagging, expiry, exception handling, and decommissioning.
• Define appropriate use cases for centralized secrets management platforms versus cloud-native services such as Azure Key Vault and AWS Secrets Manager.
• Design IAM access models using Azure Entra ID, AWS IAM, RBAC, ABAC, roles, policies, groups, service principals, managed identities, and OIDC federation.
• Implement least-privilege access models across cloud, application, infrastructure, and workload environments.
• Support application teams in onboarding and migrating from insecure, manual, or inconsistent secrets and IAM practices.
• Integrate secrets management and IAM controls with CI/CD pipelines, Kubernetes, databases, APIs, legacy applications, logging, monitoring, and SIEM platforms.
• Design and support workload identity, machine identity, service accounts, privileged access, and automated credential rotation.
• Define and implement governance processes covering ownership, support, access reviews, exception management, control monitoring, and reporting.
• Develop practical reference architectures, engineering standards, onboarding playbooks, implementation patterns, and technical documentation.
• Work closely with security, cloud, platform, infrastructure, application, risk, compliance, and audit teams to drive enterprise security initiatives.
• Support IAM and secrets management transformation initiatives across hybrid and multi-cloud environments.
• Define migration strategies, implementation roadmaps, and adoption plans for enterprise secrets and IAM capabilities.
• Establish dashboards and metrics covering secrets compliance, IAM access hygiene, credential rotation, onboarding progress, exceptions, and risk reduction.
• Support secret scanning and remediation initiatives across source code repositories, development environments.
• Promote DevSecOps practices and secure-by-design principles across development and engineering teams.
• Collaborate with development teams across India, the UK, and Dalian to drive consistent security practices and implementation standards.
• Provide technical guidance on CyberArk PAM, HashiCorp Vault Enterprise, machine identity, certificate lifecycle management, and dynamic secrets.
• Drive continuous improvement of enterprise IAM, secrets management, privileged access, and cloud security controls.

Qualifications

Bachelor’s or master’s degree in computer science, Information Technology, or a related field.