Senior Staff Engineer (Devops)

<p><strong>Requirements</strong></p><ul><li>Experience : 7.5+ years</li><li>Strong experience in <strong>DevOps and AWS</strong>, with hands-on exposure to enterprise cloud and security environments.</li><li>Strong expertise in <strong>enterprise secrets management</strong> and end-to-end <strong>IAM</strong>.</li><li>Strong knowledge of <strong>Azure Entra ID, RBAC, ABAC, and CyberArk</strong>.</li><li>Proven experience delivering at least one enterprise transformation involving secrets management, IAM, PAM, DevSecOps, cloud security, or machine identity.</li><li>Strong understanding of authentication, authorization, RBAC, ABAC, least privilege, federation, workload identity, privileged access, service accounts, access reviews, and audit controls.</li><li>Hands-on experience with Azure IAM services, including <strong>Entra ID, Azure Managed Identity, and Service Principals</strong>.</li><li>Hands-on experience with AWS IAM, including <strong>IAM roles, policies, STS, and OIDC federation</strong>.</li><li>Experience with at least two enterprise secrets management technologies such as <strong>Azure Key Vault, AWS Secrets Manager, HashiCorp Vault, CyberArk Conjur, Akeyless, Thales CipherTrust, External Secrets Operator, or Secrets Store CSI Driver</strong>.</li><li>Strong experience working across hybrid environments spanning cloud and on-premises workloads.</li><li>Experience integrating secrets management and IAM controls with CI/CD platforms such as <strong>Azure DevOps, GitHub Actions, Jenkins, or GitLab</strong>.</li><li>Experience with Kubernetes security, workload identity, service accounts, and secrets management.</li><li>Ability to define enterprise standards, target-state architecture, migration plans, governance models, and practical engineering patterns.</li><li>Strong stakeholder management skills across security, cloud, platform, infrastructure, application, risk, compliance, and audit teams.</li><li>Experience working in regulated enterprise environments such as financial services, banking, insurance, healthcare, or similar industries.</li><li>Experience with <strong>CyberArk PAM, HashiCorp Vault Enterprise, machine identity, certificate lifecycle management, or dynamic secrets</strong>.</li><li>Experience with policy-as-code and security automation tools such as <strong>Terraform, Azure Policy, AWS Organizations/SCPs, OPA, Sentinel, Checkov, Prisma Cloud, or Wiz</strong>.</li><li>Experience with secret scanning and remediation tools such as <strong>GitHub Advanced Security, GitGuardian, Gitleaks, or TruffleHog</strong>.</li><li>Experience defining security dashboards and metrics for secrets compliance, IAM access hygiene, credential rotation, onboarding progress, exceptions, and risk reduction.</li><li>Strong understanding of multi-cloud secrets management and IAM processes.</li><li>Strong analytical, problem-solving, communication, and technical documentation skills.</li><li>Ability to work effectively with geographically distributed engineering and security teams.</li></ul><p><strong>Responsibilities</strong></p><ul><li>Assess current enterprise secrets management and IAM practices across Azure, AWS, on-premises platforms, Kubernetes, CI/CD pipelines, applications, databases, APIs, and service accounts.</li><li>Define target-state architecture for enterprise secrets management, IAM integration, workload identity, privileged access, credential rotation, auditing, and governance.</li><li>Establish enterprise standards for secrets storage, access, rotation, ownership, naming, tagging, expiry, exception handling, and decommissioning.</li><li>Define appropriate use cases for centralized secrets management platforms versus cloud-native services such as Azure Key Vault and AWS Secrets Manager.</li><li>Design IAM access models using Azure Entra ID, AWS IAM, RBAC, ABAC, roles, policies, groups, service principals, managed identities, and OIDC federation.</li><li>Implement least-privilege access models across cloud, application, infrastructure, and workload environments.</li><li>Support application teams in onboarding and migrating from insecure, manual, or inconsistent secrets and IAM practices.</li><li>Integrate secrets management and IAM controls with CI/CD pipelines, Kubernetes, databases, APIs, legacy applications, logging, monitoring, and SIEM platforms.</li><li>Design and support workload identity, machine identity, service accounts, privileged access, and automated credential rotation.</li><li>Define and implement governance processes covering ownership, support, access reviews, exception management, control monitoring, and reporting.</li><li>Develop practical reference architectures, engineering standards, onboarding playbooks, implementation patterns, and technical documentation.</li><li>Work closely with security, cloud, platform, infrastructure, application, risk, compliance, and audit teams to drive enterprise security initiatives.</li><li>Support IAM and secrets management transformation initiatives across hybrid and multi-cloud environments.</li><li>Define migration strategies, implementation roadmaps, and adoption plans for enterprise secrets and IAM capabilities.</li><li>Establish dashboards and metrics covering secrets compliance, IAM access hygiene, credential rotation, onboarding progress, exceptions, and risk reduction.</li><li>Support secret scanning and remediation initiatives across source code repositories and development environments.</li><li>Promote DevSecOps practices and secure-by-design principles across development and engineering teams.</li><li>Collaborate with development teams across India, the UK, and Dalian to drive consistent security practices and implementation standards.</li><li>Provide technical guidance on CyberArk PAM, HashiCorp Vault Enterprise, machine identity, certificate lifecycle management, and dynamic secrets.</li><li>Drive continuous improvement of enterprise IAM, secrets management, privileged access, and cloud security controls.</li></ul>