Security Analyst, NHI (Non-Human Identity)

GuidePoint Security is hiring a Security Analyst, NHI to support discovery, governance, and security of non-human identities across enterprise, cloud, and DevOps environments. The role develops identity inventories, risk scoring, lifecycle governance, and remediation programs, while advancing Zero Trust and secrets management practices.

Responsibilities:

• Serve as a senior subject matter expert for Non-Human Identity (NHI) security, including service accounts, application identities, machine identities, workload identities, API identities, secrets, tokens, certificates, and other machine-to-machine credentials
• Develop and implement NHI discovery, inventory, classification, ownership, lifecycle management, and governance processes across enterprise environments
• Conduct assessments to identify unknown, orphaned, excessive, over-privileged, stale, and high-risk non-human identities
• Define and implement NHI security controls aligned with Zero Trust, least privilege, identity security, and secrets management principles
• Leverage modern NHI security platforms, preferably Oasis Security, Clutch Security, and Entro, to discover, analyze, monitor, and remediate non-human identities
• Develop NHI risk scoring and prioritization models based on privileges, exposure, usage, ownership, credential type, business criticality, and potential blast radius
• Analyze NHI relationships and dependencies across applications, infrastructure, cloud environments, APIs, databases, DevOps pipelines, and third-party platforms
• Identify and remediate credential sprawl, hardcoded secrets, excessive privileges, unused credentials, unmanaged identities, and insecure authentication mechanisms
• Establish NHI ownership and accountability by working with application owners, development teams, infrastructure teams, DevOps, cloud engineering, and security teams
• Develop and maintain NHI lifecycle processes covering creation, onboarding, authentication, authorization, rotation, monitoring, certification, suspension, and retirement
• Integrate NHI security capabilities with enterprise IAM, PAM, CIEM, CSPM, SIEM, ITSM, secrets management, and DevSecOps platforms
• Analyze authentication and activity data to identify anomalous or suspicious behavior involving non-human identities
• Support implementation of least privilege and just-in-time access for workloads, applications, APIs, and machine identities
• Develop automation to improve NHI discovery, remediation, credential rotation, ownership assignment, and policy enforcement
• Define and maintain NHI security standards, procedures, control requirements, and operating processes
• Conduct periodic NHI reviews and support access certification, audit, compliance, and risk assessments
• Develop dashboards and metrics to track NHI security posture, including inventory coverage, ownership, risk, privilege levels, credential age, remediation status, and policy compliance
• Collaborate with PAM and IAM teams to establish clear boundaries and integration between human identity, privileged identity, and non-human identity management
• Support NHI strategy, architecture, proof-of-concepts, technology evaluations, and implementation initiatives
• Stay current on emerging NHI threats, attack techniques, industry standards, and technologies related to machine identities, workload identities, secrets, APIs, and AI agents
• Mentor junior analysts and contribute to the development of NHI security playbooks, standards, and reusable analytical processes

Requirements:

• 5+ years of experience in cybersecurity, IAM, PAM, cloud security, application security, or a related security discipline
• 2+ years of experience working with non-human identities, service accounts, application identities, machine identities, workload identities, or secrets management
• Strong understanding of the Non-Human Identity security lifecycle, including discovery, classification, ownership, risk assessment, governance, monitoring, remediation, and retirement
• Strong understanding of different NHI types, including:
• Service and application accounts
• Workload and machine identities
• API identities and API keys
• Service principals
• Access tokens and OAuth credentials
• SSH keys
• Certificates
• Secrets and credentials
• CI/CD identities
• Cloud workload identities
• Containers and Kubernetes identities
• Robotic/process automation identities
• Hands-on experience with NHI security, secrets management, PAM, IAM, or identity security platforms
• Experience discovering and analyzing NHIs across cloud, on-premises, SaaS, application, DevOps, and infrastructure environments
• Strong understanding of AWS, Azure, and/or GCP identity and access management, including service principals, IAM roles, workload identities, and cloud-native credentials
• Understanding of DevOps and CI/CD environments, including GitHub/GitLab, Jenkins, Terraform, Kubernetes, containers, and other automation platforms
• Strong understanding of secrets management and credential security, including vaulting, rotation, expiration, and detection of exposed or hardcoded credentials
• Experience analyzing identity relationships and access paths to identify excessive privilege, lateral movement opportunities, toxic combinations, and potential attack paths
• Strong understanding of Zero Trust, least privilege, identity security, and defense-in-depth principles
• Experience integrating security and identity platforms with SIEM, SOAR, ITSM, PAM, IAM, CSPM, CIEM, and DevSecOps tools
• Strong analytical and problem-solving skills, with the ability to investigate complex identity relationships and security findings
• Ability to work effectively with application owners, developers, DevOps engineers, cloud engineers, infrastructure teams, security architects, and risk/compliance teams
• Strong documentation and communication skills, including the ability to translate technical NHI risks into business and security impact
• Experience developing security controls, procedures, remediation plans, dashboards, and operational playbooks
• Embraces emerging technologies, including AI tools, to work smarter, solve problems, and drive better business outcomes
• Preferred experience with Oasis Security, Clutch Security, and Entro or comparable NHI security platforms
• Exposure to NHIM platforms like Oasis Security, Clutch Security, Entro Security
• Experience implementing or operating an NHI security program within a large enterprise environment
• Experience with CyberArk, Delinea, or BeyondTrust and understanding of how PAM integrates with NHI security
• Experience with cloud-native identity technologies such as:
• AWS IAM Roles and Service Roles
• Azure Managed Identities and Service Principals
• GCP Workload Identity
• Kubernetes Service Accounts
• Experience with HashiCorp Vault or other enterprise secrets-management platforms
• Experience with OAuth 2.0, OpenID Connect, SAML, JWTs, API authentication, PKI, certificates, and SSH
• Familiarity with NHI attack paths, identity-based attack techniques, credential theft, secret leakage, and machine-to-machine authentication risks
• Experience with scripting and automation using Python, PowerShell, REST APIs, or similar technologies
• Experience creating NHI risk models, security metrics, dashboards, and executive reporting
• Relevant certifications such as CISSP, CCSP, Security+, cloud security certifications, or IAM/PAM certifications
• Experience with emerging AI agent identities and AI workload security, including governance of credentials and permissions used by AI agents and autonomous workloads