Senior Vault Engineer
Depository Trust & Clearing Corporation (DTCC)21 days ago
USA (city not specified)Senior
Responsibilities
- Design, deploy, and maintain HashiCorp Vault infrastructure across on-premises and cloud platforms.
- Implement secure, highly available, scalable, and resilient secrets management solutions.
- Configure and support Vault authentication methods and secret engines.
- Integrate Vault with CI/CD pipelines, Kubernetes, cloud services, enterprise identity providers, service meshes, and platform engineering ecosystems.
- Automate secret provisioning, rotation, access control, and certificate lifecycle management using infrastructure-as-code and scripting.
- Drive adoption of zero-trust principles, least-privilege access, short-lived credentials, workload identities, and security-first engineering practices.
- Develop automation and integrations using Python, Terraform, Jenkins, GitLab, Groovy, and REST APIs.
- Troubleshoot Vault, authentication workflows, PKI, networking, TLS, cloud infrastructure, and distributed platform issues.
- Support compliance, audit, and security requirements within regulated environments.
Requirements
- Bachelor’s degree and/or equivalent in cybersecurity or a related field.
- Minimum six years of relevant experience is stated; the success profile also specifies five or more years in security engineering, cloud infrastructure, platform engineering, or DevSecOps.
- Deep understanding of authentication, authorization, identity federation, and access management concepts.
- Hands-on experience with Vault authentication methods including OIDC, LDAP, Kubernetes, AppRole, JWT, AWS IAM, and certificate-based authentication.
- Hands-on experience with Vault secret engines including KV, PKI, Database, Transit, AWS/Azure Secrets, SSH, and dynamic secrets.
- Experience designing dynamic secrets, leased credentials, and secret rotation frameworks.
- Strong understanding of zero-trust architecture, machine identities, workload identities, least privilege, and security-by-design principles.
- Advanced automation and DevOps experience using Python, Terraform, Jenkins, GitLab, Groovy, and REST APIs.
- Experience integrating Vault with Kubernetes, service mesh technologies, and modern platform engineering ecosystems.
- Strong troubleshooting skills across networking, TLS, PKI, cloud infrastructure, authentication systems, and distributed platforms.
- Preferred qualifications include PKI, certificate lifecycle management, HSMs, enterprise key management, AWS, Azure, multi-cloud environments, monitoring and observability platforms, relevant HashiCorp, cloud, Kubernetes, or security certifications, regulated-industry experience, and SPIFFE/SPIRE or service-to-service authentication experience.
Benefits
- Competitive compensation including base pay and annual incentive.
- Comprehensive health and life insurance and well-being benefits, based on location.
- Pension and retirement benefits.
- Paid time off and personal/family care and other leaves of absence.
- Flexible hybrid work model with three days onsite and two days remote; onsite days are Tuesdays, Wednesdays, and a third day determined by the team or employee.
About Depository Trust & Clearing Corporation (DTCC)
Depository Trust & Clearing Corporation (DTCC) runs global post-trade market infrastructure, delivering clearing, settlement, securities depository, trade reporting, and data services for broker-dealers, banks, and asset managers. It provides these services through subsidiaries such as DTC, NSCC, FICC, and the Global Trade Repository, with revenue primarily from transaction and service fees. Founded in 1973 and headquartered in Jersey City, NJ, DTCC is industry-owned and privately held, serving markets across multiple regions.