Senior Staff Machine Identity and PKI Engineer
Nscale is a London-based, full-stack AI cloud and infrastructure company that provides GPU compute, managed AI services, orchestration software, data centers, and power infrastructure for AI training, fine-tuning, and inference.
Funding history
About Nscale
Nscale builds and operates vertically integrated AI infrastructure spanning software, GPU compute, networking, storage, purpose-built data centers, and power. Its active cloud platform offers self-service inference endpoints, fine-tuning, managed Kubernetes and Slurm, virtual machines, and GPU clusters.
Skills
About the Role
You will give every service account, workload, certificate, token and AI agent an identity with a named owner, least access and automatically renewing credentials. You will set technical standards across SRE, platform and product, own long-term decisions from CA design to post-quantum planning, lead certificate lifecycle management implementation, and partner with SRE on Vault.
Requirements
- 10+ years in platform engineering, infrastructure security or SRE with deep work on workload identity, secrets and PKI
- Hands-on PKI expertise including CA hierarchy design, certificate profiles, revocation and HSMs
- Experience with a certificate lifecycle management platform such as Keyfactor, Entrust, AppViewX or DigiCert
- Production experience with HashiCorp Vault including auth methods, dynamic secrets and PKI engine
- Experience with cloud workload identity, OIDC federation from CI, Kubernetes service accounts and RBAC
- Ability to write code in Go or Python and work with Terraform
Responsibilities
- Build the non-human identity register covering service accounts, CI credentials, API keys, tokens, certificates and agent identities
- Replace static long-lived credentials with short-lived workload identity using GitHub Actions OIDC, cloud workload identity federation, Kubernetes service account tokens and SPIFFE/SPIRE
- Own PKI and lead implementation of a certificate lifecycle management platform
- Automate certificate issuance and renewal using ACME, cert-manager and EST/SCEP
- Implement device certificates for managed endpoints
- Set the machine secrets standard and partner with SRE on HashiCorp Vault authentication and PKI use
- Define identity, human ownership, scoped access and kill switch for AI agents and tool integrations
- Plan for post-quantum cryptography across the certificate estate
Benefits
- Bonus
- Equity
- Medical, dental and vision
- Flexible paid time off
- Parental leave
- Retirement plan participation
- Flexible workplace