Note: The job is a remote job and is open to candidates in USA. EY is a globally connected professional services organization focused on building a better working world through assurance, consulting, tax, strategy, and transactions. EY is seeking a Senior AI Systems Engineer to build and own the security and trust fabric for its AI-native platform, including workload identity, secrets, cryptography, confidential computing, and attestation. The role ensures AI workloads are secure, auditable, and deployable across cloud, on-premises, edge, and air-gapped environments.
Responsibilities
- Own workload identity and secrets management: SPIRE/ODIS, Keycloak/Entra ID (IAM), OpenBao (secrets store), cert-manager (X.509 lifecycle), PKI issuers/roots, and transit encryption — propagated consistently across every environment and tenant
- Build confidential compute environments: TEE (TDX/SEV-SNP/SGX/TrustZone/CCA/NVIDIA CC), Intel TXT boot security, and secure DPU architecture (DOCA), so environments are isolated, attestable, and audit-ready
- Establish the platform-wide identity model so every workload, agent, and service carries a verifiable, propagated identity that flows through telemetry, cost attribution, and policy enforcement end-to-end
- Own the cryptographic lifecycle: issuance, rotation, revocation, and expiry of certificates, keys, and roots, with zero manual, untracked secrets and no long-lived credential sprawl across tenants
- Enforce attestation policy: which nodes, enclaves, and workloads are trusted, how trust is proven at boot and at runtime, and how attestation evidence is captured for audit
- Partner on a dotted-line basis with Enterprise Security / Cloud Platform / SRE to ensure independent review, alignment to enterprise trust standards, and audit readiness in regulated client contexts
Skills
- Bachelor's or Master's degree in Computer Science, Security, or related technical field, or equivalent experience
- 8+ years in security engineering, identity/PKI, or trust infrastructure, with hands-on production ownership
- Deep, hands-on expertise with workload identity (SPIRE/SPIFFE), IAM (Keycloak/Entra ID), and secrets management (OpenBao/Vault)
- Strong grounding in PKI, X.509 certificate lifecycle (cert-manager), key management, and transit encryption
- Working experience with confidential compute and hardware attestation (TDX, SEV-SNP, SGX, NVIDIA CC, or equivalents) and secure boot (Intel TXT)
- Experience delivering identity and secrets consistently across multi-tenant, multi-environment (cloud/on-prem/edge/air-gapped) platforms
- Proven track record operating under compliance, security, or regulatory constraints with audit-grade evidence requirements
- Ability to define clean ownership boundaries and consumption contracts with platform, data, and runtime teams
- Familiarity with secure DPU architectures (DOCA) and hardware root-of-trust / boot-chain designs
- Experience integrating identity and attestation into service mesh, policy engines (OPA), and API gateways
- Exposure to AI/ML workloads and the specific trust challenges of confidential AI inference (models/secrets inside enclaves)
- Experience producing attestation and compliance evidence for external auditors or regulators
- Relevant certifications (e.g., CISSP, cloud security specialties) or demonstrable equivalent depth
- Exposure to regulated industries (financial services, tax, healthcare, risk)
Benefits
- Medical and dental coverage
- Pension and 401(k) plans
- A wide range of paid time off options
- Team-led and leader-enabled hybrid model
- Under our flexible vacation policy, you’ll decide how much vacation time you need based on your own personal circumstances.
- Time off for designated EY Paid Holidays, Winter/Summer breaks, Personal/Family Care, and other leaves of absence when needed to support your physical, financial, and emotional well-being.
Company Overview
Company H1B Sponsorship