T&T | Cyber : D&R | Manager | Security Platform Engineer| Delhi

Deloitte & Touche GmbH Wirtschaftsprüfungsgesellschaft; Delhi; On-site; INR 2,500,000 - 3,500,000; Full time

Job summary

Deloitte Touche Tohmatsu India LLP in Delhi invites a Manager level Security Platform Engineer to join the Cyber team. You will assess secrets management, IAM across cloud and on‑prem environments, and define target-state architecture for governance and rotation.

You will design IAM models, implement centralized secret stores, and contribute to enterprise transformations in cloud security and DevSecOps across hybrid workloads.

Qualifications

• Hands-on experience with Azure and AWS IAM services, including Entra ID and related identity tools.
• Experience with multiple secrets management technologies (e.g., Azure Key Vault, AWS Secrets Manager, HashiCorp Vault).
• Strong understanding of IAM concepts: RBAC/ABAC, least privilege, federation, workload identity, and audit controls.

Responsibilities

• Assess current secrets management and IAM practices across cloud and on-premises environments.
• Define target-state architecture for secrets management and IAM integration.
• Create enterprise standards for secrets storage, rotation, governance, and decommissioning.
• Define use cases for centralized secrets platforms vs cloud-native tools.
• Integrate secrets management with CI/CD pipelines, Kubernetes, databases, and services.

Skills

Azure IAM

AWS IAM

Entra ID

Least-privilege

PAM/Secrets

CI/CD security

Education

B.E./B.Tech. in CS / MCA / MBA / M.Tech

Tools

HashiCorp Vault

CyberArk PAM

Terraform

OIDC/Federation

Job description

Select how often (in days) to receive an alert:

Job Title: T&T | Cyber : D&R | Manager | Security Platform Engineer| Delhi

T&T | Cyber : D&R | Manager | Security Platform Engineer| Delhi
Job requisition ID : 111092
Location: Delhi
Entity: Deloitte Touche Tohmatsu India LLP

The Team

Deloitte helps organizations prevent cyberattacks and protect valuable assets. We believe in being secure, vigilant, and resilient—not only by looking at how to prevent and respond to attacks, but at how to manage cyber risk in a way that allows you to unleash new opportunities. Embed cyber risk at the start of strategy development for more effective management of information and technology risks. Learn more about Cybersecurity

Your Work Profile

• Assess current secrets management and IAM practices across Azure, AWS, on-premises, Kubernetes, CI/CD, applications, databases, APIs, and service accounts.
• Define target-state architecture for secrets management, IAM integration, workload identity, privileged access, credential rotation, audit, and governance.
• Create enterprise standards for secrets storage, access, rotation, ownership, naming, tagging, expiry, exception handling, and decommissioning.
• Define when to use centralized secrets platforms versus cloud-native tools such as Azure Key Vault and AWS Secrets Manager.
• Design IAM access models using Azure Entra ID, AWS IAM, roles, policies, groups, service principals, managed identities, OIDC federation, and least-privilege access.
• Support onboarding and migration of application teams from insecure or inconsistent secrets and IAM practices.
• Integrate secrets management with IAM, PAM, CI/CD pipelines, Kubernetes, databases, APIs, legacy applications, logging, monitoring, and SIEM.
• Help establish operating model components such as ownership, support processes, governance, exception management, control monitoring, and reporting.
• Produce practical documentation, reference architectures, onboarding playbooks, and implementation patterns for engineering teams

Key Skills Required

• Hands-on experience with Azure and AWS IAM services, including Entra ID, Azure Managed Identity, service principals, AWS IAM roles, policies, STS, and OIDC.
• Experience with at least two secrets management technologies, such as Azure Key Vault, AWS Secrets Manager, HashiCorp Vault, CyberArk Conjur, Akeyless, Thales CipherTrust, External Secrets Operator, or Secrets Store CSI Driver, PAM, CCP
• Proven enterprise secrets management, Strong IAM knowledge across Azure Entra ID, AWS IAM, workload identity, federation, RBAC/ABAC, least privilege, service principals and managed identities/cyberark
• Experience with CyberArk PAM, HashiCorp Vault Enterprise, machine identity, certificate lifecycle, or dynamic secrets
• B.E./B.Tech. Or M.C.A/ MBA/ M.Tech. in Computer Science from a reputed University with 10-15 years of hands-on experience on below mentioned skills.
• Proven experience delivering at least one enterprise transformation in secrets management, IAM, PAM, DevSecOps, cloud security, or machine identity.
• Strong understanding of IAM concepts, including authentication, authorization, RBAC, ABAC, least privilege, federation, workload identity, privileged access, service accounts, access reviews, and audit controls.
• Experience working in hybrid environments with cloud and on-premises workloads.
• Experience integrating secrets and IAM controls with CI/CD tools such as Azure DevOps, GitHub Actions, Jenkins, GitLab, or similar.
• Ability to define enterprise standards, target-state architecture, migration plans, governance models, and practical engineering patterns.
• Strong stakeholder management skills across security, cloud, platform, infrastructure, application, risk, and audit teams.
• Experience in regulated enterprise environments such as financial services, banking, insurance, healthcare, or similar.
• Experience with policy-as-code, Terraform, Azure Policy, AWS Organizations/SCPs, OPA, Sentinel, Checkov, Prisma Cloud, Wiz, or similar tools.
• Experience with secret scanning and remediation using tools such as GitHub Advanced Security, GitGuardian, Gitleaks, TruffleHog, or similar.
• Experience defining dashboards or metrics for secrets compliance, IAM access hygiene, rotation status, onboarding progress, exceptions, and risk reduction.
• Multi-cloud IAM knowledge across Azure Entra ID, AWS IAM, workload identity, federation, RBAC/ABAC, least privilege, service principals and managed identities CI/CD and strong DevSecOps practices