Intellias
Solution Architect (Agentic Identity & Access Security)
Get notified of more jobs like this · No spam, ever
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Our client is a leading global investment management company headquartered in London. It manages over $228 billion in assets and serves institutional investors, pension funds, wealth managers, and other sophisticated clients worldwide. The firm specializes in quantitative investing, alternative investments, systematic trading strategies, and technology-driven asset management. Data science, machine learning, and AI are core components of its investment and research processes.
As part of our collaboration, we will focus on two foundational capabilities required to enable safe and scalable AI adoption across the enterprise: Agentic Security and AI-Ready Data Foundations.
We define how autonomous agents authenticate, obtain scoped access, and operate safely across a large, regulated financial estate where the runtime security model genuinely does not exist yet. The value, and the danger, of agentic AI is set by what an agent can reach: an agent that inherits a full user context and long-lived secrets has an effectively unlimited blast radius. Your job is to close that gap.
This is a hands-on principal-level role for an engineer/architect who still ships code, working at the intersection of enterprise IAM, platform engineering, and the agentic-AI security frontier, and leading a near-shore engineering team delivering against it. Much of the problem space is undefined, so you will be expected to explore it yourself, connect threads across teams and systems that do not currently talk to each other, and represent the work directly to the client. You will design and build the IaC-driven, self-service identity patterns, credential flows, and onboarding standards that make the secure way the easy way, across high-velocity teams that have long governed themselves.
Requirements:
- 8+ years in security architecture and/or platform engineering, with a track record of shipping production code. Principal-level depth, ideally in a high-velocity or quant / financial-services engineering culture.
- Deep, mechanical command of modern identity and authorisation: OIDC / OAuth2 / JWT — token issuance flows, claims design, and delegation / impersonation patterns.
- Hands-on HashiCorp Vault experience, including dynamic / short-lived secrets and the realities of migrating off long-lived tokens without breaking a large application estate at once.
- Keycloak policy modelling, ideally with the Terraform-driven configuration the firm already uses.
- Strong Terraform / IaC fluency — enough to design repeatable, self-service patterns that others adopt, rather than bespoke per-team setups.
- Working knowledge of the Active Directory + Entra legacy reality: nested groups, LDAP-backed role mapping, and the distribution-list-as-permission-group failure mode — able to design around the mess pragmatically.
- Experience leading a team of engineers, including near-shore or distributed teams — setting technical direction, reviewing designs and code, and unblocking people across time zones.
- Credible in front of a customer: able to run a working session with client stakeholders, explain security trade-offs to a non-specialist audience, and hold the room without a sales lead present.
- A self-starter. You will often be handed a vague problem with no obvious owner, and you are expected to go and find the answer yourself, then turn it into a plan the team can execute.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Nice to have:
- Real exposure to agentic / LLM systems and why they change the threat model — an agent actively probes and exploits standing permissions rather than stumbling onto them. That removes the “security through obscurity” cushion humans relied on.
- Familiarity with MCP as an integration / onboarding standard, and at least one agent harness (Claude Agent SDK preferred).
- Experience with just-in-time, task-scoped delegation versus standing access, and risk-gated credential issuance (e.g. a short-lived token issued against a CrowdStrike-style risk score).
- Behavioural baselining / anomaly detection for workloads — defining “normal” for a recurring workflow and catching deviation at volume.
- SIEM integration and action attribution: distinguishing an agent’s action from the human whose credentials it borrowed.
- Financial-services audit literacy
- Pre-sales or bid-support experience.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Responsibilities:
- Design and ship IaC-driven, self-service identity patterns that roll out firm-wide without requiring a full Active Directory cleanup first.
- Define the currently undefined agentic runtime security model: containerised code execution, permission delegation to agents, and MCP-based tool access.
- Lead the transition from long-lived secrets toward ephemeral, time-based, risk-scored credentials, scoped to task duration and issued via JWT / OIDC.
- Layer LLM / software guardrails (policy-as-text plus human review) on top of whatever hard guardrails are feasible across the estate.
- Establish an opinionated onboarding standard (e.g. mandatory MCP interfaces) and win adoption through better defaults and developer experience, not mandate alone.
- Design SIEM integration, behavioural baselining, and anomaly detection for agentic workflows, and centralise siloed audit logs to satisfy both security and regulatory requirements.
- Take bounded beachheads (for example, authenticate users and then delegate scoped access to internal systems) from vague to delivered.
- Lead the near-shore engineering team delivering this work — set technical direction, review designs and code, and build the team's depth in identity and agentic security.
- Act as the senior technical voice with the client: run design sessions, present options and trade-offs to security, platform, and business stakeholders, and translate ambiguous asks into scoped, delivered work.
Why this position:
This role covers data engineering, AI, and financial services at once, and the core problem is a hard one: letting agents reach and reason over trusted data without handing them the keys to everything. You will design and build the platforms underneath it: large-scale data systems and governance, in a heavily regulated environment. The technical ownership is real, and the patterns you set here will shape how the firm uses its data for years.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location