{"id":4309364,"url":"https://alion.io/job/atyeti-sr-vault-engineer","title":"Sr Vault Engineer","company":{"id":3800820,"name":"ATYETI","domain":"atyeti.com","url":"https://alion.io/company/atyeti","size_band":null,"is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Industrial Engineering","role_family":"Industrial Engineering","seniority":"senior","employment_type":"contractor","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure DevOps","optional":false},{"name":"GitHub","optional":false},{"name":"GitHub Actions","optional":false},{"name":"Kubernetes","optional":false},{"name":"Okta","optional":false},{"name":"ServiceNow","optional":false},{"name":"Terraform","optional":false},{"name":"Vault","optional":false},{"name":"Azure","optional":true}],"status":"live","first_seen_at":"2026-11-14T07:55:49Z","employer_posted_date":null,"last_verified_at":"2026-11-14T07:55:49Z","board_verified":false,"closed_at":null,"days_open":0,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":0},"description":"PurposeThis plan captures what an IBM HashiCorp Resident Architect (RSA) would do to move\nSynopsys from per-team namespaces to a self-service, pattern-based Vault onboarding\nmodel. It is based on the recommendations from the June 5 and June 26 working sessions\nwith the Synopsys Vault team. An RSA is onboarded into your environment as a contractor\nand builds alongside your Vault team, typically for a short engagement of around 3\nmonths part-time.Current stateSynopsys has been running Vault for about a year, with a few teams in production and\nmany in dev. Onboarding is automated for namespace creation only. Everything after that\nfalls to each team.Namespace model: Root namespace, then an admin namespace, then one namespace\nper team or application group. Teams receive namespace-level admin and manage their\nown auth methods, policies and secret engines.\nOnboarding flow: ServiceNow request, then the Vault team adds namespace and user\ndetails to Terraform and pushes the change, which triggers the pipeline that creates\nthe namespace and policies. Teams then configure Vault themselves through the CLI,\nUI or code, guided by an internal wiki.Consumers: GitHub Actions and Azure DevOps pipelines, plus Kubernetes pods.\nHuman users authenticate through Okta.Organization: No central platform team. Application teams have their own DevOps and\ninfrastructure engineers.Challenges raised by the teamMany consuming teams are new to Vault and need significant hands-on help to\nintegrate.Vault team effort grows with every team onboarded.\nPage 1 of 4Synopsys Vault Adoption: Recommended RSA Engagement Plan\nTeams on different CI platforms (Azure DevOps, GitHub, others) can't easily share the\nsame modules.No clear path to change models without disrupting teams already in flight.\nRecommended target stateThe target is a model where the Vault team's onboarding work is approving a request, and\na new team reaches its first secret in minutes.\nNamespace model: The root namespace is reserved for platform administration.\nApplication teams onboard into a shared namespace and are isolated from each other\nby ACL policies, not by separate namespaces. Additional namespaces are used only for\nbusiness-unit or operating-team boundaries.\nConsumption patterns: Two or three packaged, end-to-end onboarding paths that\ncover most use cases, built highest impact first. For Synopsys, the likely patterns are:\nGitHub Actions pipelines, JWT/OIDC auth, KV secrets\nAzure DevOps pipelines, JWT/OIDC auth, KV secrets\nKubernetes pods, service account auth, KV secrets\nOkta for human access to manage each team's secrets\nSelf-service onboarding: A central onboarding repo in Azure DevOps. A team opens a\npull request with a short request file listing team name, application ID, distribution\nemail, Okta groups and pipeline or workload identities. The Vault team approves, and\nTerraform provisions roles, policies and secret paths.\nWelcome output: Each onboarded team gets generated instructions covering login, its\nsecret path, a seeded test secret and a ready-to-use pipeline snippet.\nTwo tracks: The paved path is the default. Experienced teams that need more\nautonomy can be supported on a separate, agreed path.\nDiscoverability: Vault is documented as the secrets manager of record in an internal\ncatalog or wiki, so teams find it on their own.\nEngagement planThe RSA works inside your environment alongside the Vault team, in five phases. Each\nphase builds on evidence from the one before it.\nDiscover and assess\nPage 2 of 4Synopsys Vault Adoption: Recommended RSA Engagement Plan\nMeet with the Vault team, key stakeholders, and one or two application teams\n(current users or onboarding candidates).\nCollect data on a set of onboarding candidates: application ID, platform, runtime,\nlanguage, and where it runs (pipelines, Kubernetes, cloud, on-prem).\nIdentify the prevailing client personas and the viable auth method for each.\nScope which secret types and usage to support first.\nDesign the target model\nDefine the namespace strategy: root reserved for platform administration,\nnamespaces only for business-unit or operating-team boundaries, ACL policies for\nteam-level isolation.Select two or three consumption patterns, prioritized by highest impact and lowest\neffort.Agree on the onboarding request format (YAML or HCL) and the approval flow.\nBuild the onboarding automation\nBuild a Terraform module per consumption pattern that turns a handful of high-level\ninputs into the full Vault configuration (roles, policies, secret paths).\nStand up a central onboarding repo in Azure DevOps with documentation and a\nrequest template. Any team can open a pull request, so teams on other CI platforms\ndon't need to run the modules themselves.\nWire approval to a Terraform pipeline that provisions access automatically.\nUse Terraform templating to generate a welcome message: login URL, required Okta\ngroup, secret path, a seeded example secret, a pipeline snippet, and links to docs\nand support.Pilot and iterate\nOnboard a small cohort of willing teams that covers each pattern, and gather\nfeedback on what works and what isn't clear.\nExpand to more teams with documentation only, treating them as beta testers.\nGraduate to fully self-service pull requests, opening access gradually.\nMigrate and drive adoption\nRoute all new onboardings to the shared-namespace model while existing teams\nkeep running where they are.Communicate the new model internally and set a re-onboarding window (around 12\nmonths) for existing teams, with self-service tooling such as KV secret migration.\nPage 3 of 4Synopsys Vault Adoption: Recommended RSA Engagement Plan\nDefine the advanced-team path for teams that need their own namespace, by\nagreement.Establish Vault as the secrets manager of record: internal catalog or wiki presence,\na road show for business-unit leads, and a community channel.\nWhat success looks likeThe Vault team's onboarding work is reviewing and approving a request.\nA new team goes from request to reading a test secret in its pipeline in minutes.\nTwo or three patterns cover roughly 80% of onboarding requests.\nVault team effort no longer grows in step with the number of teams onboarded\nOriginally posted on Himalayas","description_format":"text","description_chars":6206,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["DevOps & Platform Engineering","IT Consulting & Digital Transformation","AI Consulting & Integration"],"lifecycle":[{"event":"open","at":"2026-11-14T10:46:04Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":30,"reasons":["seen:0","win:early"],"computed_at":"2026-11-14T12:48:18Z"},"pay":null,"html_url":"https://alion.io/job/atyeti-sr-vault-engineer","json_url":"https://alion.io/job/atyeti-sr-vault-engineer.json","meta":{"generated_at":"2026-11-14T12:48:18Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":12642,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3800820},"rest":"https://alion.io/mcp/rest/get_company?id=3800820"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fatyeti-sr-vault-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fatyeti-sr-vault-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fatyeti-sr-vault-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/atyeti-sr-vault-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fatyeti-sr-vault-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4309364}},{"tool":"search_jobs","arguments":{"company":"atyeti.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4309364},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}