AVP/VP, Non-Human Identity (NHI) Security Engineer (Secrets Management), Technology Group

GIC is one of the world’s largest sovereign wealth funds. With over 2,000 employees across 11 locations around the world, we invest in more than 40 countries globally across asset classes and businesses. Working at GIC gives you exposure to an extraordinary network of the world’s industry leaders. As a leading global long-term investor, we Work at the Point of Impact for Singapore’s financial future, and the communities we invest in worldwide.

Technology Group
We experiment, design, and lead a 24×7 global business where we support core capabilities in asset management, trading, investment operations, and risk management. We deliver secure, reliable, and integrated solutions, and provide insights on new, and emerging technologies. 

Infrastructure & Cybersecurity Resilience (ICR)
We design, build, and secure the technology foundations that power GIC’s global investment operations. We aim to deliver resilient, scalable, and secure infrastructure that empowers our people and businesses to perform securely, efficiently, and effectively.

What impact can you make in this role?

We are looking for a hands-on Secrets Management engineer to lead the greenfield design, build, and enterprise-wide adoption of GIC's new secrets and Non-Human Identity (NHI) platform. This role sits within IAM Engineering and reports to the Head of IAM Engineering. You will build the systems that let applications, pipelines, and infrastructure obtain the credentials, keys, and certificates they need securely, dynamically, and without human intervention.

The core of the role is deep, hands-on expertise in HashiCorp Vault, including Vault Enterprise — from architecture and initial deployment through to secure integration patterns adopted across a large, heterogeneous engineering estate spanning Kubernetes and public cloud. You will also be a strong practitioner of Infrastructure-as-Code, using Terraform and Ansible to make the platform reproducible, auditable, and self-service. This is an engineering-first, keyboard-on role: you will spend most of your time designing, building, and hardening the platform rather than managing it from a distance.

A defining feature of this role is agentic AI. You will use AI agents and LLM-based tooling as first-class engineering aids to accelerate how the platform is built, and — just as importantly — you will engineer the identity and secrets model for AI agents themselves, so that autonomous, non-human workloads can obtain short-lived, tightly scoped, fully audited credentials in the same disciplined way as human identities and other NHIs.

You will define the standard integration patterns that teams across the firm consume, and drive their adoption so that secrets sprawl, static credentials, and hard-coded keys are systematically eliminated.

What will you do as a Secrets Management Engineer? 

Secrets Management — HashiCorp Vault

• Lead GIC's greenfield HashiCorp Vault implementation end to end — reference architecture, edition and topology decisions, production readiness, and phased rollout.
• Operate the platform at enterprise scale, including multi-region highly available and disaster-recovery topologies, Integrated Storage (Raft), performance and DR replication, namespaces for multi-tenancy, Sentinel policies, and auto-unseal.
• Plan and execute the migration of existing secrets and credentials from current stores and hard-coded locations onto the new platform, with minimal disruption to application teams.
• Design and manage Vault's secrets engines — KV v2, database (dynamic credentials), PKI/certificate issuance, transit (encryption-as-a-service), SSH, cloud (AWS/Azure/GCP), and Kubernetes.
• Engineer robust authentication and authorisation — AppRole, JWT/OIDC, Kubernetes, cloud IAM auth methods, together with fine-grained ACL policies, namespaces, and entity/group governance.
• Implement dynamic secrets, short-lived credentials, secret leasing, and automated rotation to move the estate away from long-lived static credentials.
• Own the security hardening of the platform — seal/unseal key management, audit device configuration, token lifecycle, least-privilege policy design, and break-glass procedures.

Integration Patterns & Enterprise-Wide Adoption

• Design, document, and productionise standard integration patterns for consuming secrets — Vault Agent and sidecar injection, CSI Secrets Store driver, Agent templating, direct API integration, and CI/CD pipeline integration.
• Drive enterprise-wide adoption: onboard application teams, define golden paths and reusable modules, and systematically remediate hard-coded credentials and secrets sprawl across the estate.
• Integrate Vault with the broader ecosystem — Kubernetes, cloud platforms, CI/CD tooling, PKI/certificate management, databases, and observability/SIEM for auditing.
• Establish adoption metrics, self-service onboarding, and internal enablement (documentation, patterns, office hours) to scale usage without becoming a bottleneck.

Infrastructure-as-Code & Automation

• Provision and manage the platform and its configuration as code using Terraform (including the Vault provider) and Ansible — infrastructure, policies, mounts, auth backends, and roles all version-controlled and peer-reviewed.
• Build reproducible, auditable, and self-service workflows so that secrets-platform changes flow through pipelines rather than manual console changes.
• Contribute to a documentation-as-code model where configuration and its documentation live together in the repository and are machine-readable, so AI agents can safely reason over them.

DevOps, CI/CD & Reliability

• Embed secrets management into DevOps workflows using Git, GitHub, and GitHub Actions / CI-CD pipelines, ensuring pipelines authenticate to Vault securely and never persist secrets.
• Own reliability of the platform — monitoring, alerting, capacity, backup/restore and DR testing, and incident response for a Tier-0 security service.

Agentic AI — Engineering & Agent Identity

• Use agentic AI in day-to-day engineering: apply AI agents and LLM-based tools to generate and review Vault policies, Terraform/Ansible code, and integration scaffolding, to remediate findings, and to produce documentation — always with human review and guardrails.
• Design and operate the identity and secrets model for AI agents (agentic identity): treat autonomous agents as first-class NHIs that authenticate to Vault, receive dynamic, short-lived, least-privilege credentials, and are fully audited.
• Establish authentication and authorisation patterns for agents — workload identity, AppRole/JWT/OIDC or workload-identity-federation flows, scoped policies, and per-task credential issuance — so agents never hold long-lived or over-broad secrets.
• Build guardrails for agent access: strict least-privilege policies, short lease/TTL and automatic revocation, rate and blast-radius controls, approval/break-glass paths for sensitive operations, and end-to-end audit trails of what each agent accessed and why.
• Enable secure agent-driven automation and orchestration (e.g. Model Context Protocol or similar agent tooling) against the secrets platform, and define the standards other teams follow when their agents need credentials.

What qualifications or skills should you possess in this role?

Candidates must bring a minimum of 4+ years of hands-on HashiCorp Vault experience in production. The AVP vs. VP level reflects the scope, autonomy, and breadth of impact you bring. You should be able to evidence:

• Expert-level, hands-on experience with HashiCorp Vault (including Vault Enterprise) in production — not just usage, but architecting, deploying, hardening, and operating it at scale — including having led at least one greenfield Vault implementation from design through to enterprise-wide production.

• A track record of implementing standard integration patterns and driving enterprise-wide adoption of a secrets platform across many teams and technologies.

• Very strong, hands-on engineering experience running Kubernetes and at least one major public cloud (AWS, Azure, or GCP) in production at scale.

• Comfort operating a Tier-0 / mission-critical security service, with a security-and-reliability mindset.

• Well-versed, hands-on experience leveraging agentic AI / LLM tooling in day-to-day development — generating, reviewing, and refactoring code, policies, and documentation — together with an understanding of how AI agents and other NHIs securely obtain and use credentials.

• HashiCorp Vault, including Vault Enterprise — architecture, secrets engines, auth methods, ACL and Sentinel policies, namespaces, performance/DR replication, and hardening (expert).

• Terraform (incl. Vault provider) and Ansible for IaC and configuration management (strong).

• Kubernetes and at least one major cloud (AWS, Azure, or GCP) at an advanced level, including workload identity (e.g. EKS IRSA / Pod Identity, Azure Workload Identity, GCP Workload Identity Federation) and native secrets integration (strong).

• CI/CD and DevOps tooling — Git, GitHub, GitHub Actions or equivalent, with a code-first way of working.

• Scripting / automation (e.g. Python, Go, or Bash) and comfort with REST APIs.

• PKI and certificate management, encryption fundamentals, and secure credential lifecycle.

• Agentic AI for development — proficient use of AI coding agents and LLM tooling (e.g. agent frameworks, Model Context Protocol) across the engineering workflow, and familiarity with securing NHIs, including AI agents, and their secrets.

• Experience designing API-based abstraction (secrets-as-a-service) layers over the platform.

• Exposure to other secrets solutions (cloud-native secret managers, CyberArk) for migration and interoperability.

Certifications: 

• HashiCorp Certified: Vault Associate / Vault Operations Professional.

• HashiCorp Certified: Terraform Associate.

• Relevant cloud (AWS / Azure / GCP) or Kubernetes (CKA) certification.

Soft Skills: 

• Clear communicator who can explain secure patterns to engineering teams and bring them along.
• Strong sense of ownership; comfortable being hands-on and going deep to solve problems.
• Collaborative and pragmatic — able to balance security rigour with developer experience and delivery speed.
• Bias toward automation, documentation, and building things that scale beyond the individual.

Work at the Point of Impact
We need to be forward-looking to attract the right people to help us become the Leading Global Long-term Investor. Join our ambitious, agile, and diverse teams - be empowered to push boundaries and pursue innovative ideas, share your views, and be heard. Be anchored on our PRIME Values: Prudence, Respect, Integrity, Merit and Excellence, which guides us in how we make our day-to-day decisions. We strive to inspire. To make an impact. 

GIC is a Great Place to Work

At GIC, our offices are vibrant hubs for ideation, professional growth, and interpersonal connection.  At the same time, we believe that flexibility allows us to do our best work and be our best selves.  Thus, our teams come into the office four days per week to harness the benefits of in-person collaboration, but have the flexibility to choose which days they work from home and adjust this arrangement as situational needs arise. 

GIC is an equal opportunity employer 
As an employer, we passionately believe every individual brings with them unique diversity of thought and perspectives to meaningfully enrich perspectives of GIC teams to drive competitive performance. An inclusive environment yields exceptional contribution.

Learn more about our Technology Group here: 
https://gic.careers/group/technology-group/