Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 44 days agoWe saw it 117 min after it went up

Principal Platform Identity Engineer

Firmus Technologies74 open roles

Where
Melbourne, Victoria, Australia
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowPrincipal Platform Identity EngineerFirmus Technologies · Melbourne, Victoria, Australia

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Firmus Technologies's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.3% of postings close within 7 days. Measured by our own scanner across the market. Firmus Technologies postings stay open a median of 31 days.

Share of postings closed within
  1. 2.1%1 day
  2. 4.6%3 days
  3. 13.3%7 days
  4. 21.3%14 days
  5. 35.7%30 days
  6. 59.1%60 days
This job: posted 44 days ago

Firmus Technologies median: 31 days open

The posting

AI FactoryOS Operations

AI FactoryOS is Firmus' proprietary operating system for the AI Factory. It governs GPU telemetry, cooling, power and grid interaction as one integrated layer, so that every Firmus site can be optimised and monitored as a single system.

AI FactoryOS Operations runs that platform in production and owns the 24/7 reliability of AI FactoryOS, Firmus AI Cloud and the platforms built on them, together with the service levels the estate is measured against.

The remit is an engineering one. The function builds the guarded automation, remediation and operational tooling that turn manual response into a software-defined capability, and builds and operates the shared services the estate's own operation depends on. The function works closely with the engineering teams that build the platform, supplying the production evidence that shapes what they fix and what they build next.

Principal Platform Identity Engineer Role Summary

Firmus runs large-scale, state-of-the-art AI infrastructure built on the latest generation of GPU rack-scale systems and operated as one estate to power the next generation of AI innovation. The Principal Platform Identity Engineer builds and operates the trust plane the estate's administrative and privileged access depends on: workforce and privileged identity, the internal certificate authority, secrets management, and the just-in-time access model tied to the change record. This is the trust plane of the platform, the foundation that access, privilege and every service's authentication rest on.

This is a hands-on principal-level role with deep technical expertise. The trust plane is engineered, not administered: identity, certificates and secrets are provisioned as code, integrated into the delivery pipeline, and designed for rotation and recovery from the outset. The role holds key custody for the estate and carries out-of-hours accountability for the trust plane alongside a peer.

Key Responsibilities

  • Design, build and operate the workforce and service identity platform, including single sign-on and identity provider integration (for example authentik, Okta, Keycloak or Entra ID).
  • Design, build and operate the internal certificate authority and certificate lifecycle management for the estate (for example step-ca or an equivalent internal PKI), and the secrets management platform (for example OpenBao or HashiCorp Vault), including rotation, access policy and audit.
  • Automate identity, certificate and secrets provisioning as code, embedded into CI/CD and infrastructure-as-code workflows, so that access and credentials are never provisioned by hand.
  • Own the privileged access management model: just-in-time elevation tied to a change record, approval workflows, and recorded break-glass access for emergencies.
  • Implement and enforce least-privilege access patterns across the estate to the policy set by the Platform Security Engineers, and report on whether access matches the model in practice, with independent audit of that access carried out by Security.
  • Design the trust plane for resilience, including certificate and secret rotation.
  • Design and operate key custody for the estate's cryptographic material under dual control, so that no single person can access or use production key material alone, with named custodians, recorded quorum operations and an auditable custody record. Own the delegated-authority model that keeps custody and out-of-hours cover available without depending on one individual.
  • Harden the identity, certificate and secrets services to the same standard they enforce on everything else, and produce the access and certificate evidence ISO 27001, SOC 2 and enterprise customer due diligence require, for collation by the Service Delivery Manager.
  • Provide the deepest technical expertise for identity, certificate and secrets faults, approve and review just-in-time access requests that require judgement beyond the standard workflow, and mentor engineers across the function on identity and secret management practice.
  • Own the privileged access management model: just-in-time elevation tied to a change record, approval workflows, and recorded break-glass access for emergencies, designed so that no one approves their own access and privileged access to the trust plane itself is approved outside this role's own team.

Skills & Experience

Required Skills

  • Deep experience designing, building and operating identity and access management platforms, including single sign-on and identity provider integration (for example Okta, Keycloak, Entra ID or authentik).
  • Strong experience with certificate lifecycle management and internal public key infrastructure (for example step-ca, HashiCorp Vault PKI, or an equivalent internal CA).
  • Strong experience with secrets management platforms (for example HashiCorp Vault, OpenBao, or equivalent), including rotation, access policy and audit.
  • Practical experience with privileged access management, just-in-time elevation and break-glass design for production environments.
  • Experience with hardware security modules and key custody practices for production cryptographic material, including dual control or quorum-based custody models.
  • Solid understanding of zero-trust architecture principles, and how to apply them to a multi-tenant platform.
  • Experience embedding identity and secrets into CI/CD and infrastructure-as-code workflows.
  • Strong scripting or programming ability for identity automation and tooling (for example Python, Go or Bash).
  • Demonstrated experience as a senior escalation point for identity and security-adjacent faults in a 24/7 production environment.
  • Practical understanding of how identity and access controls produce evidence for frameworks such as ISO 27001 or SOC 2, including separation of duties, independent approval of privileged access, and the design of controls that hold when the person designing them is also a user of them.
  • Clear technical judgement and communication, able to explain trust-model decisions to both engineers and auditors.

Preferred Experience

  • Experience with Kubernetes-native identity patterns, such as workload identity or SPIFFE/SPIRE.
  • Experience in a multi-tenant service provider, cloud or colocation environment.
  • Familiarity with GPU or HPC infrastructure and its identity and access requirements.
  • Relevant security or identity certification (for example CISSP, or a vendor-specific identity credential).
  • A Bachelor's degree in computer science, engineering or a related discipline, or an equivalent combination of relevant experience and training.

Expected Outcomes

  • Identity, certificate and secrets services built and running to their declared service levels, with certificate expiry no longer a source of incidents.
  • Standing privileged access replaced by just-in-time elevation tied to a change record.
  • Key custody operating under dual control, with a complete custody record and a tested recovery path.
  • Certificate and secret rotation automated end to end and exercised in production rather than documented.
  • Access and certificate evidence accepted at first pass in audit and customer due diligence.

Location & Reporting

Location: Based in Australia or Singapore, with travel to Australian AI Factory sites as required.

On-call: The function runs 24/7. First line monitoring and first response sit with the operations centre. This role shares the after-hours escalation roster for its domain with the other senior engineers in the function.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Firmus Technologies's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Firmus Technologies's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Firmus Technologies's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.