AI Systems Security Engineer — Trust & Attestation Architect

EY; Alpharetta (GA); On-site; USD 107,000 - 177,000; Full time

Benefits offered by this job

Hybrid work model?"We have a flexible,

Job summary

EY is seeking AI Systems Engineers to own the security and trust fabric of EY's AI-native platform, spanning identity, secrets, cryptography, and attestation across cloud, on-prem, edge, and air-gapped environments.

You will implement workload identity management, confidential compute, attestation, and policy-driven controls, partnering with Enterprise Security, Cloud Platform, and SRE to ensure audit readiness in regulated client contexts.

Qualifications

• Bachelor’s or Master’s degree in Computer Science, Security, or related technical field, or equivalent experience.
• 8+ years in security engineering, identity/PKI, or trust infrastructure, with hands-on production ownership.
• Deep, hands-on expertise with workload identity (SPIRE/SPIFFE), IAM (Keycloak/Entra ID), and secrets management (OpenBao/Vault).
• Strong grounding in PKI, X.509 certificate lifecycle (cert-manager), key management, and transit encryption.
• Working experience with confidential compute and hardware attestation (TDX, SEV-SNP, SGX, NVIDIA CC, or equivalents) and secure boot (Intel TXT).
• Experience delivering identity and secrets consistently across multi-tenant, multi-environment (cloud/on-prem/edge/air-gapped) platforms.
• Proven track record operating under compliance, security, or regulatory constraints with audit-grade evidence requirements.
• Ability to define clean ownership boundaries and consumption contracts with platform, data, and runtime teams.

Responsibilities

• Own workload identity and secrets management across environments (SPIRE/ODIS, Keycloak/Entra ID, OpenBao, cert-manager).
• Build confidential compute environments (TEE, trusted boot, secure DPU architecture) for isolation and audit readiness.
• Establish platform-wide identity model and verifiable identities across telemetry and policy enforcement.
• Own issuance, rotation, revocation, and expiry of certificates, keys, and roots with no credential sprawl.
• Enforce attestation policy for nodes, enclaves, and workloads with audit-ready evidence.
• Partner with Enterprise Security / Cloud Platform / SRE for enterprise trust standards and audit readiness.

Skills

Workload identity

IAM

Secrets management

PKI & X.509

Confidential compute

Audit/compliance experience

Education

Bachelor’s or Master’s degree in CS/Security or related field

Job description

EY is seeking AI Systems Engineers to own the security and trust fabric of EY's AI-native platform, spanning identity, secrets, cryptography, and attestation across cloud, on-prem, edge, and air-gapped environments.

You will implement workload identity management, confidential compute, attestation, and policy-driven controls, partnering with Enterprise Security, Cloud Platform, and SRE to ensure audit readiness in regulated client contexts.