Platform Identity Engineer

FIRMUS METAL INTERNATIONAL PTE. LTD.; Singapore; On-site; SGD 180,000 - 240,000; Full time

Job summary

FIRMUS METAL INTERNATIONAL PTE. LTD. seeks a Principal Platform Identity Engineer to design and operate the trust plane of the AI estate, provisioning identity, certificates and secrets as code within CI/CD.

You will own just-in-time privileged access, rotations, audit trails, and dual-control custody for production cryptographic material, collaborating with Platform Security and Service Delivery teams in a 24/7 production environment.

Qualifications

• Design, build and operate identity and access management platforms with SSO integrations.
• Manage certificate lifecycles and internal PKI for production estates.
• Operate secrets management with rotation, policy and audit trails.
• Implement privileged access management with just-in-time elevation and approvals.
• Apply zero-trust concepts to a multi-tenant platform and CI/CD pipelines.
• Embed identity and secrets into IaC and automation tooling.

Responsibilities

• Design, build and operate the workforce and service identity platform with SSO integration.
• Operate internal certificate authority and secret management with rotation and audit.
• Automate provisioning of identity, certs and secrets via code in CI/CD pipelines.
• Own the privileged access model with just-in-time elevation and break-glass controls.
• Enforce least-privilege access and report compliance to Security and Platform Engineering.
• Manage custody of cryptographic material under dual control with auditable records.
• Provide expert troubleshooting for identity, certificate and secrets faults in a 24/7 environment.

Skills

IAM platforms

SSO integration

Certificate lifecycle

Secrets management

Privileged access mgmt

Zero-trust architecture

CI/CD & IaC

Scripting in Python/Go/Bash

24/7 production escalation

Internal PKI

Tools

HashiCorp Vault

step-ca

OpenBao

authentik

Keycloak

Entra ID

Job description

Role Summary

Firmus runs large-scale, state-of-the-art AI infrastructure built on the latest generation of GPU rack-scale systems and operated as one estate to power the next generation of AI innovation. The Principal Platform Identity Engineer builds and operates the trust plane the estate's administrative and privileged access depends on: workforce and privileged identity, the internal certificate authority, secrets management, and the just-in-time access model tied to the change record. This is the trust plane of the platform, the foundation that access, privilege and every service's authentication rest on.

This is a hands-on principal-level role with deep technical expertise. The trust plane is engineered, not administered: identity, certificates and secrets are provisioned as code, integrated into the delivery pipeline, and designed for rotation and recovery from the outset. The role holds key custody for the estate and carries out-of-hours accountability for the trust plane alongside a peer.

Key Responsibilities

• Design, build and operate the workforce and service identity platform, including single sign-on and identity provider integration (for example authentik, Okta, Keycloak or Entra ID).
• Design, build and operate the internal certificate authority and certificate lifecycle management for the estate (for example step-ca or an equivalent internal PKI), and the secrets management platform (for example OpenBao or HashiCorp Vault), including rotation, access policy and audit.
• Automate identity, certificate and secrets provisioning as code, embedded into CI/CD and infrastructure-as-code workflows, so that access and credentials are never provisioned by hand.
• Own the privileged access management model: just-in-time elevation tied to a change record, approval workflows, and recorded break-glass access for emergencies.
• Implement and enforce least-privilege access patterns across the estate to the policy set by the Platform Security Engineers, and report on whether access matches the model in practice, with independent audit of that access carried out by Security.
• Design the trust plane for resilience, including certificate and secret rotation.
• Design and operate key custody for the estate's cryptographic material under dual control, so that no single person can access or use production key material alone, with named custodians, recorded quorum operations and an auditable custody record. Own the delegated-authority model that keeps custody and out-of-hours cover available without depending on one individual.
• Harden the identity, certificate and secrets services to the same standard they enforce on everything else, and produce the access and certificate evidence ISO 27001, SOC 2 and enterprise customer due diligence require, for collation by the Service Delivery Manager.
• Provide the deepest technical expertise for identity, certificate and secrets faults, approve and review just-in-time access requests that require judgement beyond the standard workflow, and mentor engineers across the function on identity and secret management practice.
• Own the privileged access management model: just-in-time elevation tied to a change record, approval workflows, and recorded break-glass access for emergencies, designed so that no one approves their own access and privileged access to the trust plane itself is approved outside this role's own team.

Skills & Experience

Required Skills

• Deep experience designing, building and operating identity and access management platforms, including single sign-on and identity provider integration (for example Okta, Keycloak, Entra ID or authentik).
• Strong experience with certificate lifecycle management and internal public key infrastructure (for example step-ca, HashiCorp Vault PKI, or an equivalent internal CA).
• Strong experience with secrets management platforms (for example HashiCorp Vault, OpenBao, or equivalent), including rotation, access policy and audit.
• Practical experience with privileged access management, just-in-time elevation and break-glass design for production environments.
• Experience with hardware security modules and key custody practices for production cryptographic material, including dual control or quorum-based custody models.
• Solid understanding of zero-trust architecture principles, and how to apply them to a multi-tenant platform.
• Experience embedding identity and secrets into CI/CD and infrastructure-as-code workflows.
• Strong scripting or programming ability for identity automation and tooling (for example Python, Go or Bash).
• Demonstrated experience as a senior escalation point for identity and security-adjacent faults in a 24/7 production environment.
• Practical understanding of how identity and access controls produce evidence for frameworks such as ISO 27001 or SOC 2, including separation of duties, independent approval of privileged access, and the design of controls that hold when the person designing t