Cloud Platform Engineer

York Solutions, LLC; Minneapolis (MN); Hybrid; USD 120,000 - 150,000; Full time

Benefits offered by this job

BCBS Medical with multiple plans

Delta Dental plan

Eye Med Vision

Life and Accidental Death Insurance

John Hancock 401(k) Retirement Plan

Flexible work environment

Learning and development opportunities

Job summary

A leading technology solutions provider is looking for a highly skilled SPIFFE/SPIRE Security Engineer in Minneapolis, MN. This role involves supporting secure workload identity and implementing service-to-service authentication within a hybrid work environment. Candidates should have hands-on experience with SPIRE, solid understanding of workload identity concepts, and integration with Kubernetes. The role offers a flexible work setting and comprehensive benefits, including BCBS Medical and a retirement plan.

Qualifications

• Hands-on experience deploying and operating SPIRE Server and SPIRE Agent.
• Strong understanding of SPIFFE IDs, trust domains, and workload identity concepts.
• Experience building or customizing workload and node attestors.
• Ability to design and implement SVID issuance and rotation (X.509 and JWT).
• Proven experience integrating SPIRE with Kubernetes and service meshes.

Responsibilities

• Support secure workload identity and service-to-service authentication initiatives.
• Design, implement, and operate SPIFFE/SPIRE-based identity systems.

Skills

Kubernetes + mTLS

Service mesh security

PKI automation

Cloud workload identity

Vault and certificate management

Job description

Important Notice

At this time, we are unable to consider candidates requiring visa sponsorship or third-party recruitment agencies for this role. We thank you for your understanding.

We are seeking a highly skilled SPIFFE/SPIRE Security Engineer to support secure workload identity and service‑to‑service authentication initiatives. This role focuses on designing, implementing, and operating SPIFFE/SPIRE‑based identity systems in Kubernetes and service‑mesh environments.

Hybrid: 2 days / week - Downtown Minneapolis, MN (only local MN applicants).

Core Capability Areas

• Kubernetes + mTLS
• Service mesh security
• PKI automation
• Cloud workload identity
• Vault and certificate management

Required Expertise: SPIFFE / SPIRE

• Hands‑on experience deploying and operating SPIRE Server and SPIRE Agent
• Strong understanding of SPIFFE IDs, trust domains, and workload identity concepts
• Experience building or customizing workload and node attestors
• Ability to design and implement SVID issuance and rotation (X.509 and JWT)
• Proven experience integrating SPIRE with:
  • Kubernetes
  • Service meshes (e.g., Istio, Linkerd)
  • Envoy‑based workloads

Preferred Qualifications

• Experience securing large‑scale distributed systems
• Familiarity with zero‑trust architecture principles
• Strong collaboration skills with platform, security, and application teams

Benefits

• BCBS Medical with 3 Plans to choose from (PPO and High deductible PPO plans with Health Savings Program)
• Delta Dental plan with 2 free cleanings and insurance discounts
• Eye Med Vision with annual check‑ups and discounts on lens
• Life and Accidental Death Insurance paid by company
• John Hancock 401(k) Retirement Plan with discretionary company match
• Voluntary Insurance programs such as: Hospital Indemnity, Identity Protection, Legal Insurance, Long Term Care, and Pet Insurance
• Flexible work environment with some remote working opportunities
• Strong fun and teamwork environment
• Learning, development, and career growth