AI Security Engineer: Trusted Identities & Attestation

EY; Buffalo (NY); On-site; USD 107,000 - 201,000; Full time

Benefits offered by this job

Medical and dental coverage

Pension and 401(k) plans

Paid time off

Job summary

EY seeks AI Systems Engineers to own the security and trust fabric of EY's AI-native platform, covering identity, secrets, cryptography and attestation to enable trusted workloads in highly regulated environments. This role spans cloud, on‑prem, edge and air‑gapped contexts, delivering verifiable identity, protected secrets and auditable evidence to support enterprise trust and risk management.

Join EY to advance a security‑first culture with a hybrid working model, competitive rewards and broad

Qualifications

• Bachelor’s or Master’s degree in CS, security, or related field.
• 8+ years in security engineering with production ownership.
• Deep expertise with workload identity (SPIRE/SPIFFE), IAM (Keycloak/Entra ID), and secrets management (OpenBao/Vault).
• Strong PKI knowledge and X.509 lifecycle (cert-manager).
• Experience with confidential compute and hardware attestation (TDX, SEV-SNP, SGX, NVIDIA CC, or equivalents) and secure boot (Intel TXT).
• Experience delivering identity and secrets across multi-tenant, multi-environment platforms.
• Proven track record operating under compliance, security, or regulatory constraints with audit-grade evidence.
• Ability to define ownership boundaries and consumption contracts with platform, data, and runtime teams.

Responsibilities

• Own workload identity and secrets management across environments.
• Build confidential compute environments with TEE and secure DPU architecture.
• Define platform-wide identity model for telemetry, cost attribution and policy enforcement.
• Manage cryptographic lifecycle: certificates, keys, and roots across tenants.
• Enforce attestation policy for boot time and runtime, with audit evidence.
• Collaborate with Enterprise Security / Cloud Platform / SRE for audit readiness in regulated contexts.

Skills

Identity management

Secrets management

PKI

Attestation

Confidential compute

TEEs

Auditability

Security mindset

Multi-environment

Education

Bachelor’s or Master’s in CS/Security

Tools

SPIRE/SPIFFE

Keycloak/Entra ID

OpenBao/Vault

cert-manager

X.509 lifecycle

TDX/SEV-SNP/SGX

Intel TXT

DOCA

Job description

EY seeks AI Systems Engineers to own the security and trust fabric of EY's AI-native platform, covering identity, secrets, cryptography and attestation to enable trusted workloads in highly regulated environments. This role spans cloud, on‑prem, edge and air‑gapped contexts, delivering verifiable identity, protected secrets and auditable evidence to support enterprise trust and risk management.

Join EY to advance a security‑first culture with a hybrid working model, competitive rewards and broad