Security Analyst, NHI – Non-Human Identity

This is a fully remote position, open to applicants in United States.

📋 Description

• Assist in the discovery, governance, and security of non-human identities across enterprise, cloud, and DevOps environments.

• Act as a senior subject matter expert for service accounts, application identities, machine identities, workload identities, API identities, secrets, tokens, certificates, and other machine-to-machine credentials.

• Create and implement processes for NHI discovery, inventory, classification, ownership, lifecycle management, and governance.

• Perform assessments to identify unknown, orphaned, excessive, over-privileged, stale, and high-risk non-human identities.

• Establish and enforce NHI security controls that align with Zero Trust, least privilege, identity security, and secrets management principles.

• Utilize NHI security platforms to discover, analyze, monitor, and address non-human identities.

• Develop models for risk scoring and prioritization of NHI.

• Examine NHI relationships and dependencies across applications, infrastructure, cloud environments, APIs, databases, DevOps pipelines, and third-party platforms.

• Identify and resolve credential sprawl, hardcoded secrets, excessive privileges, unused credentials, unmanaged identities, and insecure authentication methods.

• Define NHI ownership and accountability, collaborating with application, development, infrastructure, DevOps, cloud engineering, and security teams.

• Develop and maintain lifecycle processes for NHI that encompass creation, onboarding, authentication, authorization, rotation, monitoring, certification, suspension, and retirement.

• Integrate NHI security capabilities with IAM, PAM, CIEM, CSPM, SIEM, ITSM, secrets management, and DevSecOps platforms.

• Analyze authentication and activity data to detect anomalous or suspicious behaviors of non-human identities.

• Facilitate least privilege and just-in-time access for workloads, applications, APIs, and machine identities.

• Create automation for NHI discovery, remediation, credential rotation, ownership assignment, and policy enforcement.

• Define and maintain standards, procedures, control requirements, and operational processes for NHI security.

• Conduct periodic reviews of NHI and support access certification, audit, compliance, and risk assessments.

• Create dashboards and metrics to track NHI security posture, inventory coverage, ownership, risk, privilege levels, credential age, remediation status, and policy compliance.

• Collaborate with PAM and IAM teams on the boundaries and integration of human, privileged, and non-human identity management.

• Support NHI strategy, architecture, proof-of-concepts, technology evaluations, and implementation initiatives.

• Remain informed about NHI threats, attack techniques, standards, and technologies.

• Mentor junior analysts and contribute to NHI security playbooks, standards, and reusable analytical processes.

⛳️ Requirements

• A minimum of 5 years of experience in cybersecurity, IAM, PAM, cloud security, application security, or a related discipline.

• At least 2 years of experience working with non-human identities, service accounts, application identities, machine identities, workload identities, or secrets management.

• Strong understanding of the Non-Human Identity security lifecycle, which includes discovery, classification, ownership, risk assessment, governance, monitoring, remediation, and retirement.

• In-depth knowledge of service and application accounts, workload and machine identities, API identities and API keys, service principals, access tokens and OAuth credentials, SSH keys, certificates, secrets and credentials, CI/CD identities, cloud workload identities, containers and Kubernetes identities, and robotic/process automation identities.

• Practical experience with NHI security, secrets management, PAM, IAM, or identity security platforms.

• Experience in discovering and analyzing NHIs across cloud, on-premises, SaaS, application, DevOps, and infrastructure environments.

• Proficient understanding of AWS, Azure, and/or GCP identity and access management.

• Familiarity with DevOps and CI/CD environments, including GitHub/GitLab, Jenkins, Terraform, Kubernetes, containers, and other automation platforms.

• Comprehensive knowledge of secrets management and credential security, which includes vaulting, rotation, expiration, and detection of exposed or hardcoded credentials.

• Experience in analyzing identity relationships and access paths to pinpoint excessive privilege, lateral movement opportunities, toxic combinations, and potential attack paths.

• Strong grasp of Zero Trust, least privilege, identity security, and defense-in-depth principles.

• Experience integrating security and identity platforms with SIEM, SOAR, ITSM, PAM, IAM, CSPM, CIEM, and DevSecOps tools.

• Excellent analytical and problem-solving abilities.

• Capability to work effectively with application owners, developers, DevOps engineers, cloud engineers, infrastructure teams, security architects, and risk/compliance teams.

• Strong documentation and communication skills, particularly in translating technical NHI risks into business and security impacts.

• Experience in developing security controls, procedures, remediation plans, dashboards, and operational playbooks.

• Willingness to embrace emerging technologies, including AI tools.

• Preferred experience with Oasis Security, Clutch Security, Entro, CyberArk, Delinea, BeyondTrust, HashiCorp Vault, OAuth 2.0, OpenID Connect, SAML, JWTs, API authentication, PKI, certificates, SSH, Python, PowerShell, and REST APIs.

• Relevant certifications such as CISSP, CCSP, Security+, cloud security certifications, or IAM/PAM certifications are preferred.

• Sedentary work requiring substantial wrist, hand, and/or finger movement for at least 8 hours a day.

• Close visual acuity for computer terminal viewing and/or extensive reading for a minimum of 8 hours a day.

🏝️ Benefits

• Primarily remote workforce (U.S. based only).

• Group Medical Insurance options: Zero Deductible PPO Plan with GuidePoint covering 90% of the employee premium and 70% of family premiums, or High Deductible Health Plan with HSA with GuidePoint covering 100% of employee premiums and 75% of family premiums.

• HSA contribution of $850 annually for employees or $1,750 annually for families.

• Group Dental Insurance with GuidePoint covering 100% of employee premiums and 75% of family premiums.

• 12 corporate holidays.

• Flexible Time Off (FTO) program.

• Healthy mobile phone and home internet allowance.

• Eligibility for retirement plan after 2 months at open enrollment.

• Pet Benefit Option.

• Up to 10% travel may be required.