Note: The job is a remote job and is open to candidates in USA. True Zero Technologies is a veteran-owned small business that delivers technology and cybersecurity services through a people-focused culture. The Secrets Management Platform Engineer will design, implement, and operate an enterprise secrets management platform across applications, cloud environments, and CI/CD workflows, while automating credential lifecycle processes, enforcing least privilege, and supporting AWS GovCloud and Zero Trust requirements.
Responsibilities
- Onboard applications, services, users, and machine identities into a centralized secrets management platform such as CyberArk or HashiCorp Vault, based on the selected enterprise platform
- Design and implement secure processes for credential provisioning, storage, retrieval, rotation, revocation, and retirement
- Integrate AWS Secrets Manager and AWS Systems Manager Parameter Store with enterprise applications and cloud-native workloads
- Develop and enforce least-privilege Identity and Access Management policies for access to secrets, credentials, encryption keys, and privileged services
- Automate secrets management workflows using Python, Terraform, Ansible, and approved infrastructure-as-code technologies
- Integrate secrets management into CI/CD pipelines and DevSecOps workflows to eliminate manually managed or embedded credentials
- Design and support secrets integration for containers, Kubernetes-based workloads, cloud services, virtual machines, and application platforms
- Implement and maintain PKI and certificate management processes, including certificate issuance, renewal, rotation, revocation, and expiration monitoring
- Eliminate hard-coded credentials, static passwords, embedded API keys, and unmanaged secrets from source code, configuration files, scripts, pipelines, and application deployments
- Implement FIPS 140-2/3 validated cryptographic controls and integrate secrets-management solutions with AWS KMS in AWS GovCloud where required
- Configure authentication methods and access policies for users, applications, workloads, and machine identities
- Implement dynamic or short-lived credentials where supported to reduce reliance on long-lived static secrets
- Maintain centralized auditing, logging, monitoring, and alerting for secrets access, administrative activity, credential rotation, and policy violations
- Develop and enforce governance standards for secret ownership, naming, classification, access, rotation frequency, expiration, and lifecycle management
- Partner with application, cloud, platform, cybersecurity, and DevSecOps teams to integrate secrets-management capabilities into enterprise architectures and development workflows
- Troubleshoot authentication, authorization, credential rotation, certificate, API, and platform integration issues
- Maintain technical documentation, onboarding procedures, platform standards, operational runbooks, and governance processes
- Continuously improve platform availability, scalability, automation, security controls, onboarding efficiency, and operational resilience
Skills
- • Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Systems, or a related technical discipline
- • Demonstrated experience implementing or administering an enterprise secrets management platform such as CyberArk or HashiCorp Vault
- • Experience with AWS Secrets Manager, AWS Systems Manager Parameter Store, and AWS KMS
- • Strong understanding of Identity and Access Management, role-based access control, policy-based access, and least-privilege principles
- • Hands-on automation experience using Python, Terraform, and/or Ansible
- • Experience integrating secrets-management solutions with CI/CD pipelines, DevSecOps workflows, and automated deployment processes
- • Experience with PKI, certificate management, encryption, key management, and certificate lifecycle automation
- • Understanding of container and cloud security, including secrets integration for Kubernetes, containerized applications, and cloud-native workloads
- • Experience designing credential rotation, dynamic secrets, machine identity, and privileged-access workflows
- • Familiarity with FIPS 140-2/3 validated cryptography and cryptographic requirements for government or regulated environments
- • Experience implementing controls to identify and eliminate hard-coded credentials and unmanaged secrets
- • Strong understanding of Zero Trust principles, particularly least privilege, identity-based access, continuous verification, and credential minimization
- • Experience with centralized logging, monitoring, auditing, compliance reporting, and security-event integration
- • Strong troubleshooting, documentation, governance, automation, and cross-functional collaboration skills
- • AWS Certified Security – Specialty
- • AWS Certified Solutions Architect – Associate
- • HashiCorp Certified: Vault Associate or applicable CyberArk Defender/Sentry certification, based on the selected secrets-management platform
- • Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM)
- • Experience supporting AWS GovCloud, government, defense, or other regulated cloud environments is preferred
Benefits
- Best in class medical coverage
- 100% of medical premiums covered by True Zero
- Company wide new business incentive programs
- Contribution Incentives (i.e. white papers, blog posts, internal webinars, etc.)
- 3 weeks of PTO starting + 11 Paid Holidays Annually
- 401k Program with 100% company match on the first 4%
- Monthly reimbursement of Cell Phone and Home Internet costs
- Paternity/Maternity Leave
- Investment in training and certifications to broaden and deepen your technical skills
Company Overview
Company H1B Sponsorship