Intellias
Agentic Identity & Access Security Architect
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Senior Security Architect – Agentic Security & AI-Ready Data Foundations
Location: London Industry: Financial Services | AI/Quantitative Investing ** Firm:** Leading global investment manager
About the Firm
Our client is a $228+ billion asset manager, specialising in quantitative investing, systematic trading, and AI-driven research. At the intersection of finance and technology, they operate in highly regulated environments where data science, machine learning, and agentic AI are crucial to their operations. This role sits within a cross-functional team embedding enterprise security controls for cutting-edge AI adoption.
Project Overview
We are shaping two foundational pillars for secure, scalable AI:
- Agentic Security: Designer of authentication, scoped access, and runtime security for autonomous agents in a large, regulated financial estate—eliminating blind spots in credential management.
- AI-Ready Data Foundations: Architecting identity patterns, credential flows, and delegation standards ensuring safe agentic interaction with core systems, from production secrets to multi-cloud infrastructure.
Key challenge: Agents inherit human context + long-lived secrets, creating unprecedented risk. Your work will redefine secure interaction designs—e.g., short-lived credentials, real-time approvals—making compliant operations default, not optional. This is not just theory: a hands-on role tweaking code in production, enforcing automation where copy/paste once ruled.
Primary Responsibilities
Security Architecture & Design
- Agentic Runtime Security Model: Define an agent-operating framework—how agents authenticate, request scoped access, and execute safely, addressing underlying IaC and containerisation.
- Credential Quantity & Qualities: Replace long-lived secrets yesterday with ephemeral, risk-gated (e.g., CrowdStrike-style scoring), task-scoped credentials via OIDC/JWT.
- Policy Stackation: Layer guardrails atop agents, including policy-as-code + human review, bridging regulatory compliance and reactivity to emerging threats.
- Toolchain Enforcement: Establish an opinionated onboarding standard (primarily Microsoft’s MCP interface) for developer adoption, emphasising better defaults over mandates.
- Audit & SIEM: Centralise logs, configure behavioural baselines for agentic workflows, and harden action-attribution (e.g., distinguishing when an agent stealthily finds permissions).
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Engineering & Infrastructure
- IaCOwnership: Architect Terraform-driven self-service identity patterns deployable without AD-level redesign; migrate away from legacy (e.g., AD groups/DL usage).
- Token Flows: Debug/scalable flows for dynamic secret rotation, including migration from long-lived tokens to Vault or HashiCorp Vault-based policies.
- Identity Evolution:
- Hands-on with JWT/OIDC/OAuth2. Prefer delegation > flat permissions.
- Pragmaticzg management of AD + Entra + LDAP, e.g., mapping permissions across nested groups.
Delivery Governance
- Security as Opinion: Shape an adder-friendly guardrail layer that embeds security seamlessly in rapid deployments, not via friction.
- Beachhead Strategy: Bound risk to tangible pilots—e.g., user auth → delegation to private TKTs.
Key Requirements
Core
- 8+ years in security architecture/platform engineering, shipping production-grade IaC, tools, and code.
- Principal/staff level fluency in OIDC/OAuth2 JWT flows (especially claims design, token delegation).
- Deep HashiCorp Vault expertise: strategic secrets rotation, cooperative Vault policies, and legacy-token breakage plans.
- Keycloak (especially Terraform-driven policies/variables) familiarity.
- Microsoft platforms: MCP adoption, Active Directory + Entra, and risk-scoped credential/risk-signal integration (e.g., CrowdStrike alerts).
- Prismatic Terraform for reproducible setups, not per-team spaghetti.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Nice-to-Haves
- Agentic/LLM security research (agents inherently probe permissions programmatically, not collaterally).
- JIT task delegation frameworks (e.g., command-and-request routes between humans/agents).
- LBAs (Leaderboard Members/Black Belt Community) with applied risk detection (e.g., Envoy Happiness measurement inputs).
- Whence Hornscan/Mandiant-style anomaly detection at scale.
- Patina workforce privilege identity sizing (quantification of vaulted secrets).
- Client/Consulting experience where Rust/Go terraformed toolchains help grow 4-digit annual revenues.
Why This Role?
You’ll design platforms at the very front end of AI maturity, merging high-finance governance with emerging AI threat surfaces. Shape how firms safeguard data without suffocating clever delegation — this is a divorce of core value from grass-fire risks. Shipping will focus as much on next-gen delegation as on internal reviews.
[More disposable notes: Expect significant interaction with quant/fixed-income clients.]
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location