Senior AI Security & Trust Engineer - Secure Execution

EY; Seattle (WA); Hybrid; USD 107,000 - 177,000; Full time

Benefits offered by this job

Hybrid work model

Total rewards package

Paid time off

Job summary

EY is seeking AI Systems Engineers to own the security and trust fabric of EY’s AI-native platform, spanning identity, secrets, cryptographic, and attestation layers across cloud, on‑prem, edge, and air‑gapped environments.

You will own the enforcement mechanisms to prove workloads are identity-bound, secrets protected, and deployments attestable, enabling secure AI in regulated industries.

Qualifications

• Deep expertise in workload identity, secrets management, PKI, and cryptographic lifecycle at prod scale across environments.
• Strong grounding in confidential compute, trusted execution environments, hardware roots of trust, and remote attestation.
• A security‑first mindset focused on provable trust and policy enforcement.

Responsibilities

• Own workload identity and secrets management across environments and tenants (SPIRE/ODIS, Keycloak/Entra ID, OpenBao, cert-manager).
• Build confidential compute environments with TEE and secure boot to ensure isolated, attestable workloads.
• Establish a platform‑wide identity model for verifiable identity flow through telemetry and policy enforcement.
• Own cryptographic lifecycle: issuance, rotation, revocation, expiry of certificates/keys with no long‑lived secrets.
• Enforce attestation policy for nodes, enclaves, and workloads with audit evidence capture.
• Collaborate with Enterprise Security / Cloud Platform / SRE for audit readiness in regulated contexts.

Skills

Workload identity

Secrets management

PKI

Confidential compute

Attestation

Auditing & compliance

Education

Bachelor’s or Master’s degree in Computer Science, Security, or related field

Tools

SPIRE/SPIFFE

Keycloak/Entra ID

OpenBao

cert-manager

TDX/SEV-SNP/SGX

Job description

EY is seeking AI Systems Engineers to own the security and trust fabric of EY’s AI-native platform, spanning identity, secrets, cryptographic, and attestation layers across cloud, on‑prem, edge, and air‑gapped environments.

You will own the enforcement mechanisms to prove workloads are identity-bound, secrets protected, and deployments attestable, enabling secure AI in regulated industries.