AI Systems Engineer: Secure Execution & Identity Trust

EY; Southfield (MI); Hybrid; USD 107,000 - 177,000; Full time

Benefits offered by this job

Hybrid work model

Medical and dental coverage

Pension and 401(k)

Paid time off

Flexible vacation policy

Job summary

EY is seeking AI Systems Engineers to own the security and trust fabric of EY's AI-native platform, spanning identity, secrets, cryptographic controls, and attestation across cloud, on-prem, edge, and air-gapped environments.

You will drive workload identity, cryptographic lifecycle, and attestation governance in a highly regulated context. This role demands strong cross-team collaboration and a security-first mindset.

Qualifications

• Bachelor’s or Master’s degree in Computer Science, Security, or related field.
• 8+ years in security engineering, identity/PKI, or trust infrastructure with hands-on ownership.
• Deep experience with workload identity (SPIRE/SPIFFE), IAM (Keycloak/Entra ID), and secrets management (OpenBao/Vault).
• Strong PKI knowledge and X.509 certificate lifecycle (cert-manager).
• Confidential compute and hardware attestation (TDX/SEV-SNP/SGX/NVIDIA CC) and secure boot (Intel TXT).
• Experience delivering identity and secrets across multi-tenant, multi-environment platforms.
• Proven track record operating under compliance/audit constraints with audit-grade evidence.
• Ability to define ownership boundaries and consumption contracts with platform/data/runtime teams.

Responsibilities

• Own workload identity and secrets management across environments.
• Build confidential compute environments with TEEs and secure boot.
• Establish a platform-wide identity model for telemetry, cost attribution, and policy enforcement.
• Own the cryptographic lifecycle: issuance, rotation, revocation, expiry.
• Enforce attestation policy for nodes, enclaves, and workloads.
• Collaborate with Enterprise Security / Cloud Platform / SRE for audit readiness.

Job description

EY is seeking AI Systems Engineers to own the security and trust fabric of EY's AI-native platform, spanning identity, secrets, cryptographic controls, and attestation across cloud, on-prem, edge, and air-gapped environments.

You will drive workload identity, cryptographic lifecycle, and attestation governance in a highly regulated context. This role demands strong cross-team collaboration and a security-first mindset.