Identity & Trust Service Manager

ROLE PURPOSE

Verisure protects millions of families and businesses through connected devices, cloud platforms and a 24/7 operation. Trust in every person, machine, device and secret that touches that service is a core security capability, not a supporting function.

The Identity & PKI Manager is accountable end to end for that capability. The role owns the strategy, design, operation and commercial management of Verisure's identity and trust platforms, and leads a team of security engineers to deliver them as products with clear SLAs, measurable risk reduction and executive visibility.

KEY ACCOUNTABILITIES

1. Strategy and roadmap

• Define and deliver a multi-year Identity & Trust roadmap aligned with the Security strategy, Zero Trust principles and business priorities.

• Extend identity framework from people to non-human identities and AI agents under a single control model.

2. Unified IAM technical lifecycle

• Onboard new systems under the unified IAM: establish SailPoint as the single authority for joiner-mover-leaver, and bring applications, platforms and business-owned systems under it through a standard onboarding model, connectors and acceptance criteria.

• Reduce the footprint of local administration: retire locally managed user provisioning and deprovisioning, shrink manual and delegated admin processes, and track coverage, orphaned accounts and provisioning time as board-level indicators.

• Maintain Entra ID as the secure corporate identity plane, including Conditional Access, PIM and passwordless authentication.

• Own privileged access (PAM) and secrets management as one continuum, from human administrators to machine and pipeline credentials.

3. PKI service design and management

• Trust architecture: own the design of the corporate and device PKI, including CA hierarchy, certificate profiles, certificate policy and practice statements, HSM and key custody, and key ceremonies.

• Device PKI at scale: design and run the identity and certificate lifecycle for connected devices, from factory provisioning through enrolment, renewal and revocation, in partnership with Product, Engineering and manufacturing partners.

• Service model: define the PKI service catalogue, SLAs, ownership and operating procedures; set the standards for certificate usage across the company.

4. Operations, platform maintenance and resilience

• Guarantee availability, performance and security of all platforms in scope, with disciplined incident, problem and change management.

• Platform maintenance: own the full platform lifecycle: patching, upgrades, version currency, capacity, connector health, licence management, technical debt and end-of-life planning.

• Ensure tested disaster recovery for critical services: CA hierarchy, device certificate issuance, privileged vaults and secrets stores.

• Run the domain through KPIs and KRIs: IAM coverage, PAM coverage, expired certificates, secret rotation, provisioning time, platform currency and audit findings.

5. Vendor and partner management

• Manage manufacturers, integrators and managed service providers: contracts, SLAs, renewals, roadmap alignment and performance.

6. Leadership of the security engineering team

• Lead, develop and retain a team of security engineers; define roles, career paths and capacity plans.

• Drive a product-based, automation-first and DevSecOps operating model, in line with the domain-based organisation of Security Architecture and Engineering.

PROFILE

Essential

• Degree in Computer Science, Telecommunications Engineering or equivalent; a master's in cybersecurity is a plus.

• 5+ years in cybersecurity or IT, including 3+ years leading technical teams.

• Proven experience in at least three of: IGA, Entra ID, PKI, PAM, secrets management.

• Track record owning a service end to end: roadmap, design, operations, budget and suppliers.

• Executive communication in English and Spanish.

Valued

• Device PKI at scale in IoT or industrial environments.

• Experience driving enterprise-wide IAM consolidation and decommissioning of local admin processes.

• Non-human identity, AI agent identity and modern authorisation models.

• CISSP, CISM, CCSP, or SailPoint, Microsoft or CyberArk certifications.

• Multinational, regulated or critical-infrastructure environments.