Identity AI Security Architect

• Reference architecture for AI agent identity: registration, attestation, credential issuance, scoping, revocation
• Delegation and on-behalf-of patterns — token exchange, audience restriction, downscoping across multi-agent call chains
• Tool/function invocation authorization: per-tool entitlement, policy enforcement at the agent or LLM gateway, approval gates for high-consequence actions
• MCP and tool-protocol security — server trust, tool-definition integrity, confused-deputy prevention
• Containment patterns that assume the reasoning layer is compromised and enforce least privilege at the identity layer
• Workload identity to replace long-lived secrets: SPIFFE/SPIRE, cloud workload identity federation, mTLS, short-lived credentials
• NHI discovery, ownership, recertification, and deprovisioning integrated into existing IGA
• Behavioral telemetry for agent and workload identity misuse; threat models via MITRE ATLAS and OWASP LLM Top 10
• Security reference architecture, patterns, standards, exception governance
• Zero trust across identity, device, network, app, data
• IAM/IGA/PAM, multi-cloud security, Dev Sec Ops  and supply chain, cryptography and key management
• Executive and audit advisory; mentorship of senior architects

Title:

Indentity AI Security Architect

Location:

Remote

Duration:
Full Time

Identity: NHI & AI security

• Reference architecture for AI agent identity: registration, attestation, credential issuance, scoping, revocation
• Delegation and on-behalf-of patterns — token exchange, audience restriction, downscoping across multi-agent call chains
• Tool/function invocation authorization: per-tool entitlement, policy enforcement at the agent or LLM gateway, approval gates for high-consequence actions
• MCP and tool-protocol security — server trust, tool-definition integrity, confused-deputy prevention
• Containment patterns that assume the reasoning layer is compromised and enforce least privilege at the identity layer
• Workload identity to replace long-lived secrets: SPIFFE/SPIRE, cloud workload identity federation, mTLS, short-lived credentials
• NHI discovery, ownership, recertification, and deprovisioning integrated into existing IGA
• Behavioral telemetry for agent and workload identity misuse; threat models via MITRE ATLAS and OWASP LLM Top 10
• Security reference architecture, patterns, standards, exception governance
• Zero trust across identity, device, network, app, data
• IAM/IGA/PAM, multi-cloud security, Dev Sec Ops  and supply chain, cryptography and key management
• Executive and audit advisory; mentorship of senior architects

• Security reference architecture, patterns, standards, exception governance
• Zero trust across identity, device, network, app, data
• IAM/IGA/PAM, multi-cloud security, Dev Sec Ops  and supply chain, cryptography and key management
• Executive and audit advisory; mentorship of senior architects

• 12+ years security, 5+ in senior/principal architecture at enterprise scale
• Deep identity architecture ownership across workforce, privileged, and machine identity
• Command of OAuth 2.0/2.1, OIDC, JWT, RFC 8693 token exchange, mTLS, ABAC/ReBAC, policy-as-code
• Hands‑on securing production AI or agentic systems
• Secrets management and workload identity platforms; cloud security depth in two or more providers
• Codes well enough to prototype and review application code in design sessions

• Production MCP servers, agent frameworks, or LLM gateways
• IETF WIMSE and emerging machine identity standards
• NHI security tooling; machine identity in SailPoint/Saviynt
• Regulated industry experience (FedRAMP, DFARS/CMMC, PCI DSS, NERC CIP)

• Design and develop enterprise cyber security strategy and architecture
• Understand security requirements by evaluating business strategies and conducting…