> Markdown version of [/jobs/ext/2298463-ai-systems-engineer-secure-execution-senior](https://www.wearedevelopers.com/jobs/ext/2298463-ai-systems-engineer-secure-execution-senior). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# AI Systems Engineer - Secure Execution - Senior

- **Company:** Ernst & Young LLP
- **Location:** Columbus, OH, United States
- **Experience:** Expert
- **Salary:** $106,900.0 - $176,500.0
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Cloud Computing Security, Data Auditing, Identity and Access Management, Key Management, Public Key Infrastructure, X.509, Cloud Platform System, Okta, Istio, Information Technology, U-Boot, Api Gateway
- **Published:** August 29, 2026
- **Apply:** https://www.columbusjobsite.com/job.asp?id=3369503991&tx=FP10198LFU&pt=1&aff=0B19D771-A501-4A5E-8338-2A822B784D54&utm_source=Job%20Feed&utm_medium=textkernel&utm_campaign=DE&utm_term=0B19D771-A501-4A5E-8338-2A822B784D54

## About the Role

* Deep expertise in workload identity, secrets management, PKI, and cryptographic lifecycle at production scale across multiple environments.
 * Strong understanding of confidential compute, trusted execution environments, hardware roots of trust, and remote attestation.
 * A security-first mindset: thinking in terms of provable trust, blast radius, least privilege, and cryptographic attribution rather than perimeter or convenience.
 * Ability to encode trust and compliance directly into infrastructure so that security is enforced by the platform, not by manual review.
 * Comfortable operating across cloud, on-prem, edge, and air-gapped environments with consistent identity and trust mechanisms.
 * Strong communicator able to explain trust, identity, and attestation tradeoffs to engineers, architects, auditors, and leadership.
 * Orientation toward auditability and evidence: able to translate regulatory expectations into technical controls and demonstrable proof.

To qualify you must have

 * Bachelor's or Master's degree in Computer Science, Security, or related technical field, or equivalent experience.
 * 8+ years in security engineering, identity/PKI, or trust infrastructure, with hands-on production ownership.
 * Deep, hands-on expertise with workload identity (SPIRE/SPIFFE), IAM (Keycloak/Entra ID), and secrets management (OpenBao/Vault).
 * Strong grounding in PKI, X.509 certificate lifecycle (cert-manager), key management, and transit encryption.
 * Working experience with confidential compute and hardware attestation (TDX, SEV-SNP, SGX, NVIDIA CC, or equivalents) and secure boot (Intel TXT).
 * Experience delivering identity and secrets consistently across multi-tenant, multi-environment (cloud/on-prem/edge/air-gapped) platforms.
 * Proven track record operating under compliance, security, or regulatory constraints with audit-grade evidence requirements.
 * Ability to define clean ownership boundaries and consumption contracts with platform, data, and runtime teams.

Ideally, you'll also have

 * Familiarity with secure DPU architectures (DOCA) and hardware root-of-trust / boot-chain designs.
 * Experience integrating identity and attestation into service mesh, policy engines (OPA), and API gateways.
 * Exposure to AI/ML workloads and the specific trust challenges of confidential AI inference (models/secrets inside enclaves).
 * Experience producing attestation and compliance evidence for external auditors or regulators.
 * Relevant certifications (e.g., CISSP, cloud security specialties) or demonstrable equivalent depth.
 * Exposure to regulated industries (financial services, tax, healthcare, risk).

## Description

* Own workload identity and secrets management: SPIRE/ODIS, Keycloak/Entra ID (IAM), OpenBao (secrets store), cert-manager (X.509 lifecycle), PKI issuers/roots, and transit encryption - propagated consistently across every environment and tenant.
 * Build confidential compute environments: TEE (TDX/SEV-SNP/SGX/TrustZone/CCA/NVIDIA CC), Intel TXT boot security, and secure DPU architecture (DOCA), so environments are isolated, attestable, and audit-ready.
 * Establish the platform-wide identity model so every workload, agent, and service carries a verifiable, propagated identity that flows through telemetry, cost attribution, and policy enforcement end-to-end.
 * Own the cryptographic lifecycle: issuance, rotation, revocation, and expiry of certificates, keys, and roots, with zero manual, untracked secrets and no long-lived credential sprawl across tenants.
 * Enforce attestation policy: which nodes, enclaves, and workloads are trusted, how trust is proven at boot and at runtime, and how attestation evidence is captured for audit.
 * Partner on a dotted-line basis with Enterprise Security / Cloud Platform / SRE to ensure independent review, alignment to enterprise trust standards, and audit readiness in regulated client contexts.


## Related Videos

- [This Machine Ends Data Breaches](https://www.wearedevelopers.com/videos/574-this-machine-ends-data-breaches)
- [Rate-limiting using eBPF and Istio: How to protect your SaaS customers from themselves](https://www.wearedevelopers.com/videos/100220-rate-limiting-using-ebpf-and-istio-how-to-protect-your-saas-customers-from-themselves)
- [An alternative approach to digital sovereignty: Confidential Computing](https://www.wearedevelopers.com/videos/100043-an-alternative-approach-to-digital-sovereignty-confidential-computing)
- [Get started with securing your cloud-native Java microservices applications](https://www.wearedevelopers.com/videos/123-get-started-with-securing-your-cloud-native-java-microservices-applications)
- [Building Sovereign AI: Lessons from Deploying Secure RAG Systems using Confidential Computing](https://www.wearedevelopers.com/videos/100108-building-sovereign-ai-lessons-from-deploying-secure-rag-systems-using-confidential-computing)
- [Next-gen CI/CD with Gitops and Progressive Delivery](https://www.wearedevelopers.com/videos/1603-next-gen-ci-cd-with-gitops-and-progressive-delivery)

## Related Articles

- [Trustworthy AI Starts at Deployment: 5 Checks Before You Ship](https://www.wearedevelopers.com/magazine/753-trustworthy-ai-starts-at-deployment-5-checks-before-you-ship)
- [Navigating the AI Shift](https://www.wearedevelopers.com/magazine/629-navigating-the-ai-shift)
- [Stephan Gillich - Bringing AI Everywhere](https://www.wearedevelopers.com/magazine/489-stephan-gillich-bringing-ai-everywhere)
- [Best US AI Conferences for CTOs in 2026: Build vs. Buy, Vendor Evaluation, and Peer Intelligence](https://www.wearedevelopers.com/magazine/736-best-us-ai-conferences-for-ctos-in-2026-build-vs-buy-vendor-evaluation-and-peer-intelligence)
- [Got AI ideas but no money? Here are 10 free ways to level up your AI skills with Google Cloud](https://www.wearedevelopers.com/magazine/600-got-ai-ideas-but-no-money-here-are-10-free-ways-to-level-up-your-ai-skills-with-google-cloud)
- [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again)