Lead Systems Engineer, Secrets and Vault Engineering
Intercontinental Exchange6 months ago
Base Salary
$149k - $180k/yr
Responsibilities
- Design, build, and maintain platform services for secrets management, certificate lifecycle, encryption key management, and policy enforcement.
- Develop Python, Shell, and Ansible automation and tooling to streamline operations and enforce security controls.
- Build self-service capabilities for application teams using templates, declarative manifests, and approval workflows integrated with enterprise systems such as ServiceNow.
- Collaborate with application, infrastructure, security, and compliance teams to develop reliable and governed services.
- Shape roadmap initiatives involving SPIFFE/SPIRE, policy-as-code, workload identity, and identity controls for AI and machine-driven workloads.
- Participate in code reviews, design reviews, architecture discussions, documentation, runbooks, knowledge-sharing, and a light on-call rotation.
- Mentor and coach engineers earlier in their careers.
Requirements
- At least 7 years of infrastructure, platform, or systems engineering experience.
- Production experience with HashiCorp Vault, including secret engines, authentication methods, policies, and operational concerns.
- Strong proficiency in Python and Shell scripting, plus experience with Ansible for configuration management and orchestration.
- Understanding of identity, authentication, and secure communication protocols including TLS, OAuth, OIDC, and x.509.
- Working knowledge of CI/CD tooling such as Jenkins, GitHub Actions, or GitLab CI and Infrastructure-as-Code, preferably Terraform.
- Experience designing and consuming APIs and strong Linux systems fundamentals.
- Ability to write production-quality code, communicate design trade-offs, collaborate across teams, and mentor engineers.
- Bachelor's degree in Computer Science, Engineering, or a related field is preferred.
- Preferred experience includes self-service Vault, secrets, or cryptography platforms; SPIFFE/SPIRE; policy-as-code tools such as Open Policy Agent or HashiCorp Sentinel; AI/ML infrastructure; post-quantum cryptography; AWS, GCP, or hybrid cloud environments; AWS Secrets Manager or KMS; Docker, Kubernetes, or OpenShift; threat modeling; secrets rotation; secret-zero patterns; zero trust architectures; and regulated or security-sensitive industries.
Benefits
- Regular full-time employees are eligible for medical, dental, and vision coverage, a 401(k) plan, life insurance, time off, and paid leave for qualifying circumstances.
- The listed New York role is onsite, as indicated by the #LI-ONSITE designation.
Tech Stack
AnsibleAWSDockerGitHub ActionsGitLab CI/CDGoogle Cloud PlatformJenkinsKubernetesLinuxOpenShiftPythonTerraform
Categories
About Intercontinental Exchange
Intercontinental Exchange operates global exchanges and clearing houses, offers fixed income and commodities trading platforms, and sells market data, listings, and mortgage technology to financial institutions and lenders. Its revenue comes from transaction and clearing fees, data subscriptions, listings, and software. Founded in 2000 and headquartered in Atlanta, it owns the New York Stock Exchange and ICE Mortgage Technology, and is publicly traded on the NYSE under the ticker ICE.