***Global Identity Security (Open to Vietnamese and International Experts).***
*Lead the architecture, engineering, and security of enterprise-wide Identity & Access Management across global operations. Drive Zero Trust identity strategy covering cloud, hybrid infrastructure, applications, privileged access, machine identities, and AI agents while partnering with Security, Cloud, DevOps, and Enterprise Architecture teams worldwide.*
**I. KEY RESPONSIBILITIES**
the enterprise Identity Security architecture and strategy across workforce, privileged, application, workload, machine, and AI identities, spanning the hybrid and multi-cloud environments above.
- **Design and implement secure authentication, authorization, federation, identity lifecycle, and access governance**
across SSO, MFA, Conditional Access, RBAC/ABAC, JIT/JEA, Least Privilege, PAM, and PIM.
- **Architect secure identity federation for both human and non-human identities:**
service accounts, managed identities, workload identities, machine identities, and AI agent identities.
identity for CI/CD, Kubernetes, APIs, and service-to-service, cross-account, cross-project, cross-subscription, and cross-cloud access.
- **Build security controls**
for AI agents and agentic applications, including delegation, tool/API access, agent-to-agent communication, and least-privilege execution.
identity attack paths, excessive privileges, trust relationships, delegation chains, and privilege-escalation scenarios.
enterprise standards, reference architectures, baselines, and reusable patterns using Terraform/IaC, GitOps, APIs, and Policy-as-Code; lead architecture reviews, PoCs, and security assessments.
**II. REQUIRED TECHNICAL EXPERTISE**
Enterprise IAM architecture; identity lifecycle (Joiner-Mover-Leaver); SSO & federation; RBAC/ABAC; Least Privilege; access governance & reviews; PAM; JIT/JEA/PIM; identity threat modeling and attack-path analysis.
OAuth 2.0, OIDC, SAML 2.0, JWT/JWKS, X.509/PKI, token exchange; issuer/subject/audience validation, claims & attribute mapping, token lifetime and credential security.
- **Enterprise & Cloud Identity:**
Microsoft Entra ID / Active Directory; AWS IAM & IAM Identity Center; Google Cloud IAM; Azure RBAC / Managed Identity; Workload Identity Federation; service accounts and service principals.
- **App, Workload & AI Identity:**
Enterprise apps & APIs, microservices, Kubernetes workloads, CI/CD (GitLab / GitHub / Jenkins / Argo CD / Terraform), machine-to-machine auth, and secrets/credential management.
- **AI Agent Identity Security:**
Human-to-agent delegation; agent-to-tool/API authorization; agent-to-agent auth; scoped short-lived credentials; permission boundaries; agent lifecycle, ownership & accountability; action provenance; preventing agent privilege escalation.
Privilege escalation, excessive permissions, trust-relationship abuse, credential theft, federation abuse, service and privileged-account compromise, identity-based lateral movement.
- **Automation & Engineering:**
Terraform/IaC, GitOps, Python or Go, REST APIs, Policy-as-Code, CI/CD automation.
**III. QUALIFICATIONS**
- 8 – 10+ years of experience, including 6+ years in enterprise Identity Security architecture and engineering at large scale.
- Proven design and implementation of enterprise IAM across complex hybrid and multi-cloud environments, for both human and non-human identities (including emerging AI Agent Identity models).
- Strong hands-on engineering: able to implement and troubleshoot identity solutions rather than rely on GUI administration, and to mitigate the identity threats listed above.
- Experience leading cross-team technical initiatives, with strong architecture, communication, and documentation skills.
***PREFERRED EXPERIENCE***
Entra ID PIM / Conditional Access; HashiCorp Vault; Wiz or equivalent CNAPP; OPA/Rego (Policy-as-Code); enterprise PKI; IGA platforms; AI agent / agentic architectures.
CISSP, CCSP, CKS, AWS Security Specialty, Google Professional Cloud Security Engineer, or Microsoft Cybersecurity Architect Expert.
**IV. WHAT SUCCESS LOOKS LIKE**
The successful candidate can design and implement an enterprise identity architecture covering:
**Human Identity → Authentication → Federation → Authorization → Privileged Access → Application Identity → Workload Identity → Machine Identity → AI Agent Identity → Resource Access**
and can determine, for every critical identity:
- Who is this identity?
- How is it authenticated?
- Why is it trusted?
- What can it access?
- Who authorized the access?
- What is it acting on behalf of?
- How long does the access exist?
- Can the identity delegate or escalate its privileges?
- What happens if the identity is compromised?
- Can the access be removed automatically?
- Can the entire control be enforced, monitored, and audited through automation?
