Senior Staff Machine Identity and PKI Engineer

Role overview Set technical direction for machine identity, secrets and public key infrastructure across platform, reliability and product teams. The work centers on giving non-human identities clear ownership and limited access, replacing long-lived credentials with automatically renewed ones, and building a certificate lifecycle that can adapt to future cryptographic changes. This is a senior individual contributor role with broad influence over long-term security standards.

Responsibilities - Create an inventory of service accounts, CI credentials, API keys, tokens, certificates and AI agent identities, documenting each identity’s owner, access scope and rotation schedule. - Replace static credentials with short-lived workload identities using federation, OIDC, Kubernetes service accounts and SPIFFE/SPIRE where appropriate. - Own PKI design and guide selection and rollout of a certificate lifecycle management platform. - Automate certificate issuance and renewal, and introduce device certificates for managed endpoints. - Define how workloads authenticate to and use the secrets platform, partnering with the SRE team. - Establish identity controls for AI agents and integrations, including accountable human owners, scoped permissions and tested revocation; plan for post-quantum cryptography.

Requirements - More than ten years in platform engineering, infrastructure security or site reliability engineering, with deep experience in workload identity, secrets and PKI. - Experience designing certificate authority hierarchies and setting standards used across multiple teams. - Hands-on knowledge of certificate profiles, revocation and hardware security modules, plus experience with a certificate lifecycle platform. - Production experience with Vault, including authentication methods, dynamic secrets and its PKI capabilities. - Experience with cloud workload identity, CI OIDC federation, Kubernetes service accounts and role-based access control. - Ability to write Go or Python and work with Terraform.

Nice to have - Experience with workload identity on Google Cloud.

Benefits and work setup - Flexible work arrangements and scope to lead cross-functional initiatives. - Compensation includes a stated US base range of $210,000–$270,000, with potential bonus and equity. The listing also describes medical, dental and vision coverage, paid time off, parental leave and retirement plan participation.