Secrets Management Platform Engineer (R-00196)

The Secrets Management Platform Engineer designs, implements, and operates a centralized enterprise secrets management platform that securely manages credentials, keys, certificates, tokens, and other sensitive authentication material across applications, services, cloud environments, and CI/CD workflows.

This role is responsible for onboarding thousands of applications and services into the secrets management platform; automating credential provisioning, retrieval, and rotation; integrating secrets management into DevSecOps and cloud-native workloads; enforcing least-privilege access; and maintaining compliance through auditing, monitoring, policy enforcement, and lifecycle governance.

The engineer will support AWS GovCloud and Zero Trust requirements by eliminating hard-coded credentials, implementing strong identity-based access controls, using FIPS 140-2/3 validated cryptography, and integrating with AWS KMS and approved secrets-management services.

• Onboard applications, services, users, and machine identities into a centralized secrets management platform such as CyberArk or HashiCorp Vault, based on the selected enterprise platform.
• Design and implement secure processes for credential provisioning, storage, retrieval, rotation, revocation, and retirement.
• Integrate AWS Secrets Manager and AWS Systems Manager Parameter Store with enterprise applications and cloud-native workloads.
• Develop and enforce least-privilege Identity and Access Management policies for access to secrets, credentials, encryption keys, and privileged services.
• Automate secrets management workflows using Python, Terraform, Ansible, and approved infrastructure-as-code technologies.
• Integrate secrets management into CI/CD pipelines and DevSecOps workflows to eliminate manually managed or embedded credentials.
• Design and support secrets integration for containers, Kubernetes-based workloads, cloud services, virtual machines, and application platforms.
• Implement and maintain PKI and certificate management processes, including certificate issuance, renewal, rotation, revocation, and expiration monitoring.
• Eliminate hard-coded credentials, static passwords, embedded API keys, and unmanaged secrets from source code, configuration files, scripts, pipelines, and application deployments.
• Implement FIPS 140-2/3 validated cryptographic controls and integrate secrets-management solutions with AWS KMS in AWS GovCloud where required.
• Configure authentication methods and access policies for users, applications, workloads, and machine identities.
• Implement dynamic or short-lived credentials where supported to reduce reliance on long-lived static secrets.
• Maintain centralized auditing, logging, monitoring, and alerting for secrets access, administrative activity, credential rotation, and policy violations.
• Develop and enforce governance standards for secret ownership, naming, classification, access, rotation frequency, expiration, and lifecycle management.
• Partner with application, cloud, platform, cybersecurity, and DevSecOps teams to integrate secrets-management capabilities into enterprise architectures and development workflows.
• Troubleshoot authentication, authorization, credential rotation, certificate, API, and platform integration issues.
• Maintain technical documentation, onboarding procedures, platform standards, operational runbooks, and governance processes.
• Continuously improve platform availability, scalability, automation, security controls, onboarding efficiency, and operational resilience.

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Systems, or a related technical discipline.
• Demonstrated experience implementing or administering an enterprise secrets management platform such as CyberArk or HashiCorp Vault.
• Experience with AWS Secrets Manager, AWS Systems Manager Parameter Store, and AWS KMS.
• Strong understanding of Identity and Access Management, role-based access control, policy-based access, and least-privilege principles.
• Hands-on automation experience using Python, Terraform, and/or Ansible.
• Experience integrating secrets-management solutions with CI/CD pipelines, DevSecOps workflows, and automated deployment processes.
• Experience with PKI, certificate management, encryption, key management, and certificate lifecycle automation.
• Understanding of container and cloud security, including secrets integration for Kubernetes, containerized applications, and cloud-native workloads.
• Experience designing credential rotation, dynamic secrets, machine identity, and privileged-access workflows.
• Familiarity with FIPS 140-2/3 validated cryptography and cryptographic requirements for government or regulated environments.
• Experience implementing controls to identify and eliminate hard-coded credentials and unmanaged secrets.
• Strong understanding of Zero Trust principles, particularly least privilege, identity-based access, continuous verification, and credential minimization.
• Experience supporting AWS GovCloud, government, defense, or other regulated cloud environments is preferred.
• Experience with centralized logging, monitoring, auditing, compliance reporting, and security-event integration.
• Strong troubleshooting, documentation, governance, automation, and cross-functional collaboration skills.

Preferred Certifications:

• AWS Certified Security – Specialty
• AWS Certified Solutions Architect – Associate
• HashiCorp Certified: Vault Associate or applicable CyberArk Defender/Sentry certification, based on the selected secrets-management platform
• Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM)

Originally posted on Himalayas