Senior Secrets Platform Engineer — Zero Trust & Automation

United States Digital Space LLC

United States

Remote

USD 120,000 - 190,000

Full time

14 days+

Get more replies from employers

Send a job-specific resume in minutes.

Benefits offered by this job

Competitive salary

Best medical coverage

401k with company match

PTO + holidays

Cell phone & home internet stipends

Family leave & training investments

Job summary

True Zero is seeking a Secrets Platform Engineer to design, implement, and operate a centralized enterprise secrets management platform across applications, services, cloud environments, and CI/CD workflows. The role emphasizes onboarding thousands of assets, enforcing least-privilege access, and maintaining compliance through auditing and lifecycle governance.

The engineer will work with CyberArk or HashiCorp Vault, AWS Secrets Manager, AWS KMS, and AWS GovCloud to eliminate hard-coded

Qualifications

Bachelor’s degree in Cybersecurity, CS, IT, IS, or related discipline.
Experience implementing or administering an enterprise secrets platform (CyberArk or Vault).
Experience with AWS Secrets Manager, Systems Manager Parameter Store, and AWS KMS.
Strong understanding of IAM, RBAC, policy-based access, and least-privilege principles.
Hands-on automation with Python, Terraform, and Ansible.
Experience integrating secrets-management with CI/CD pipelines, DevSecOps workflows, and automated deployment processes.
Experience with PKI, certificate management, encryption, key management, and certificate lifecycle automation.
Understanding of container and cloud security, including secrets integration for Kubernetes and cloud-native workloads.

Responsibilities

Onboard applications, services, users, and machine identities into a centralized secrets management platform such as CyberArk or HashiCorp Vault.
Design and implement secure processes for credential provisioning, storage, retrieval, rotation, revocation, and retirement.
Integrate AWS Secrets Manager and AWS Systems Manager Parameter Store with enterprise applications and cloud-native workloads.
Develop and enforce least-privilege IAM policies for access to secrets and credentials.
Automate secrets management workflows using Python, Terraform, Ansible, and IaC technologies.
Integrate secrets management into CI/CD pipelines and DevSecOps workflows to eliminate hard-coded credentials.
Design and support secrets integration for containers, Kubernetes, cloud services, VMs, and platforms.
Implement PKI and certificate management processes, including issuance, renewal, rotation, and monitoring.
Eliminate hard-coded credentials and unmanaged secrets from code, configs, and deployments.
Implement FIPS 140-2/3 cryptography and integrate with AWS KMS in GovCloud where required.
Configure authentication methods and access policies for users, apps, workloads, and machines.
Implement dynamic/short-lived credentials where possible.
Maintain centralized auditing, logging, monitoring, and alerting for secrets access and policy violations.
Governance of secret ownership, naming, classification, access, rotation, expiration, and lifecycle management.
Partner with teams to embed secrets-management into enterprise architectures and workflows.
Troubleshoot authentication, credential rotation, certificate, and integration issues.
Maintain technical docs, runbooks, and governance processes.
Improve platform availability, scalability, and security controls.