Machine Identity Service Architect

About Atos

Must-have expertise

• Architected and productized identity or PKI services; implementation-only experience is not sufficient.
• PKI design includes X.509/RFC 5280, CA hierarchy, certificate profiles, CP/CPS, CRL/OCSP, and WebTrust or ETSI audit frameworks.
• HSM and key custody expertise includes PKCS#11, FIPS 140-3, and hands-on participation in a witnessed key ceremony.
• Know ACME, EST, SCEP, CMP, Microsoft auto-enrolment, and Microsoft AD CS, plus at least one of EJBCA, Entrust, or DigiCert.
• Experience with CLM platforms such as Idira Certificate Manager (formerly Venafi), Keyfactor, AppViewX, or DigiCert Trust Lifecycle Manager.
• Workload identity knowledge includes SPIFFE/SPIRE, Kubernetes service account tokens, cloud identity federation, mTLS, and service mesh.
• Kubernetes administrator-depth skills and Azure, AWS, or GCP cloud IAM knowledge are required.
• Machine identity governance covers service accounts, managed identities, service principals, OAuth application grants, and API keys.
• Post-quantum expertise includes NIST FIPS 203/204/205, hybrid certificates, migration planning, and crypto-agility.

Good-to-have expertise

• IDnomic experience is listed as good to have.
• Machine identity governance platforms listed include Cisco/Astrix, Entro, Natoma, Oasis, SailPoint, and Saviynt non-human identity.
• Cryptographic discovery tooling such as Keyfactor/InfoSec Global or SandboxAQ is beneficial.
• Vault or Akeyless secrets management experience at the integration boundary is beneficial.

Work location

• The posting lists Mumbai and Bangalore as work locations.

Responsibilities

• Architect and productize identity or PKI services, including reference architectures, platform evaluation and selection, and service definitions.
• Design PKI structures, certificate profiles, policy and practice statements, revocation approaches, and audit-ready frameworks.
• Work with HSMs and key custody, including participating in witnessed key ceremonies.
• Support certificate enrolment and renewal protocols across relevant platforms.
• Design and work with machine identity lifecycle management and workload identity across Kubernetes and cloud environments.
• Address machine identity governance, including ownership inference and reduction of identity scope.
• Plan post-quantum cryptography readiness, cryptographic inventory, migration, and crypto-agility.