Senior AI Trust & Security Systems Engineer

EY; Providence (RI); Hybrid; USD 107,000 - 177,000; Full time

Benefits offered by this job

Hybrid work model

Medical and dental coverage

401(k) + pension

Job summary

EY seeks AI Systems Engineers to own the security fabric of EY's AI-native platform, spanning identity, secrets, cryptography, and attestation across cloud, on-prem, edge, and air-gapped environments.

You’ll enforce cryptographic lifecycles, boot/runtime attestation, and platform-wide identity models, collaborating with Enterprise Security, Cloud Platform, and SRE teams to meet audit readiness in regulated client contexts.

Qualifications

• Bachelor’s or Master’s degree in Computer Science, Security, or related technical field, or equivalent experience.
• 8+ years in security engineering, identity/PKI, or trust infrastructure, with hands-on production ownership.
• Deep, hands-on expertise with workload identity (SPIRE/SPIFFE), IAM (Keycloak/Entra ID), and secrets management (OpenBao/Vault).
• Strong grounding in PKI, X.509 certificate lifecycle (cert-manager), key management, and transit encryption.
• Working experience with confidential compute and hardware attestation (TDX, SEV-SNP, SGX, NVIDIA CC, or equivalents) and secure boot (Intel TXT).
• Experience delivering identity and secrets consistently across multi-tenant, multi-environment (cloud/on-prem/edge/air-gapped) platforms.
• Proven track record operating under compliance, security, or regulatory constraints with audit-grade evidence requirements.
• Ability to define clean ownership boundaries and consumption contracts with platform, data, and runtime teams.

Responsibilities

• Own workload identity and secrets management: SPIRE/ODIS, Keycloak/Entra ID (IAM), OpenBao (secrets store), cert-manager (X.509 lifecycle), PKI issuers/roots, and transit encryption - propagated consistently across every environment and tenant.
• Build confidential compute environments: TEE (TDX/SEV-SNP/SGX/TrustZone/CCA/NVIDIA CC), Intel TXT boot security, and secure DPU architecture (DOCA), so environments are isolated, attestable, and audit-ready.
• Establish the platform-wide identity model so every workload, agent, and service carries a verifiable, propagated identity that flows through telemetry, cost attribution, and policy enforcement end-to-end.
• Own the cryptographic lifecycle: issuance, rotation, revocation, and expiry of certificates, keys, and roots, with zero manual, untracked secrets and no long-lived credential sprawl across tenants.
• Enforce attestation policy: which nodes, enclaves, and workloads are trusted, how trust is proven at boot and at runtime, and how attestation evidence is captured for audit.
• Partner on a dotted-line basis with Enterprise Security / Cloud Platform / SRE to ensure independent review, alignment to enterprise trust standards, and audit readiness in regulated client contexts.

Skills

workload identity

secrets management

PKI

confidential compute

attestation

cloud/on-prem/edge

Education

Bachelor’s or Master’s degree in Computer Science/Security or related field

Tools

SPIRE/SPIFFE

Keycloak/Entra ID

OpenBao

cert-manager

TDX/SEV-SNP/SGX/TrustZone

DOCA

Intel TXT

Job description

EY seeks AI Systems Engineers to own the security fabric of EY's AI-native platform, spanning identity, secrets, cryptography, and attestation across cloud, on-prem, edge, and air-gapped environments.

You’ll enforce cryptographic lifecycles, boot/runtime attestation, and platform-wide identity models, collaborating with Enterprise Security, Cloud Platform, and SRE teams to meet audit readiness in regulated client contexts.