Security Analyst, NHI (Non-Human Identity)

GuidePoint Security provides trusted cybersecurity expertise, solutions and services that help organizations make better decisions and minimize risk. By taking a three-tiered, holistic approach for evaluating security posture and ecosystems, GuidePoint enables some of the nation’s top organizations, such as Fortune 500 companies and U.S. government agencies, to identify threats, optimize resources and integrate best-fit solutions that mitigate risk. General Description We are looking for a skilled Security Analyst, NHI to support the discovery, governance, and security of non-human identities — service accounts, application and machine identities, workload identities, secrets, tokens, and certificates — across enterprise, cloud, and DevOps environments. This role will engage in the development of NHI discovery and inventory, risk scoring and prioritization, and lifecycle and remediation programs while providing “Wow Them” service to clients and/or internal customers or co-workers. The Security Analyst, NHI will be required to demonstrate strong identity security, cloud security, and secrets management skills, lead by influence, and strong business/financial acumen to drive the use of progressive non-human identity security and Zero Trust programs that will align the delivery business objectives and priorities. About the Non-Human Identity (NHI) Security Practice The Non-Human Identity (NHI) Security practice is responsible for securing the rapidly growing population of machine and workload identities that power modern enterprise, cloud, and automation environments. We discover, classify, govern, monitor, and remediate non-human identities and their credentials across the organization. Our team of NHI security analysts, identity architects, and consultants focuses on service and application accounts, workload and machine identities, API identities, secrets, tokens, certificates, and cloud-native credentials — applying Zero Trust, least privilege, and secrets management principles with modern NHI platforms such as Oasis Security, Clutch Security, and Entro. We partner with application owners, DevOps, cloud engineering, infrastructure, and security teams to reduce credential sprawl, eliminate excessive privilege, and deliver measurable, lasting identity security outcomes. Establishing enterprise-wide NHI discovery, inventory, ownership, and lifecycle governance across cloud, on-premises, SaaS, and DevOps environments. Reducing non-human identity risk through risk scoring, remediation of orphaned, stale, and over-privileged identities, and secrets protection. Integrating NHI security with IAM, PAM, CIEM, CSPM, SIEM, and DevSecOps platforms to secure machine-to-machine and emerging AI agent identities. Roles and Responsibilities: Serve as a senior subject matter expert for Non-Human Identity (NHI) security, including service accounts, application identities, machine identities, workload identities, API identities, secrets, tokens, certificates, and other machine-to-machine credentials. Develop and implement NHI discovery, inventory, classification, ownership, lifecycle management, and governance processes across enterprise environments. Conduct assessments to identify unknown, orphaned, excessive, over-privileged, stale, and high-risk non-human identities. Define and implement NHI security controls aligned with Zero Trust, least privilege, identity security, and secrets management principles. Leverage modern NHI security platforms, preferably Oasis Security, Clutch Security, and Entro, to discover, analyze, monitor, and remediate non-human identities. Develop NHI risk scoring and prioritization models based on privileges, exposure, usage, ownership, credential type, business criticality, and potential blast radius. Analyze NHI relationships and dependencies across applications, infrastructure, cloud environments, APIs, databases, DevOps pipelines, and third-party platforms. Identify and remediate credential sprawl, hardcoded secrets, excessive privileges, unused credentials, unmanaged identities, and insecure authentication mechanisms. Establish NHI ownership and accountability by working with application owners, development teams, infrastructure teams, DevOps, cloud engineering, and security teams. Develop and maintain NHI lifecycle processes covering creation, onboarding, authentication, authorization, rotation, monitoring, certification, suspension, and retirement. Integrate NHI security capabilities with enterprise IAM, PAM, CIEM, CSPM, SIEM, ITSM, secrets management, and DevSecOps platforms. Analyze authentication and activity data to identify anomalous or suspicious behavior involving non-human identities. Support implementation of least privilege and just-in-time access for workloads, applications, APIs, and machine identities. Develop automation to improve NHI discovery, remediation, credential rotation, ownership assignment, and policy enforcement. Define and maintain NHI security standards, procedures, control requirements, and operating processes. Conduct periodic NHI reviews and support access certification, audit, compliance, and risk assessments. Develop dashboards and metrics to track NHI security posture, including inventory coverage, ownership, risk, privilege levels, credential age, remediation status, and policy compliance. Collaborate with PAM and IAM teams to establish clear boundaries and integration between human identity, privileged identity, and non-human identity management. Support NHI strategy, architecture, proof-of-concepts, technology evaluations, and implementation initiatives. Stay current on emerging NHI threats, attack techniques, industry standards, and technologies related to machine identities, workload identities, secrets, APIs, and AI agents. Mentor junior analysts and contribute to the development of NHI security playbooks, standards, and reusable analytical processes. Required Experience and Education: 5+ years of experience in cybersecurity, IAM, PAM, cloud security, application security, or a related security discipline. 2+ years of experience working with non-human identities, service accounts, application identities, machine identities, workload identities, or secrets management. Strong understanding of the Non-Human Identity security lifecycle, including discovery, classification, ownership, risk assessment, governance, monitoring, remediation, and retirement. Strong understanding of different NHI types, including: Service and application accounts Workload and machine identities API identities and API keys Service principals Access tokens and OAuth credentials SSH keys Certificates Secrets and credentials CI/CD identities Cloud workload identities Containers and Kubernetes identities Robotic/process automation identities Hands-on experience with NHI security, secrets management, PAM, IAM, or identity security platforms. Preferred experience with Oasis Security, Clutch Security, and Entro or comparable NHI security platforms. Experience discovering and analyzing NHIs across cloud, on-premises, SaaS, application, DevOps, and infrastructure environments. Strong understanding of AWS, Azure, and/or GCP identity and access management, including service principals, IAM roles, workload identities, and cloud-native credentials. Understanding of DevOps and CI/CD environments, including GitHub/GitLab, Jenkins, Terraform, Kubernetes, containers, and other automation platforms. Strong understanding of secrets management and credential security, including vaulting, rotation, expiration, and detection of exposed or hardcoded credentials. Experience analyzing identity relationships and access paths to identify excessive privilege, lateral movement opportunities, toxic combinations, and potential attack paths. Strong understanding of Zero Trust, least privilege, identity security, and defense-in-depth principles. Experience integrating security and identity platforms with SIEM, SOAR, ITSM, PAM, IAM, CSPM, CIEM, and DevSecOps tools. Strong analytical and problem-solving skills, with the ability to investigate complex identity relationships and security findings. Ability to work effectively with application owners, developers, DevOps engineers, cloud engineers, infrastructure teams, security architects, and risk/compliance teams. Strong documentation and communication skills, including the ability to translate technical NHI risks into business and security impact. Experience developing security controls, procedures, remediation plans, dashboards, and operational playbooks. Embraces emerging technologies, including AI tools, to work smarter, solve problems, and drive better business outcomes. Preferred Experience and Education Exposure to NHIM platforms like Oasis Security, Clutch Security, Entro Security. Experience implementing or operating an NHI security program within a large enterprise environment. Experience with CyberArk, Delinea, or BeyondTrust and understanding of how PAM integrates with NHI security. Experience with cloud-native identity technologies such as: AWS IAM Roles and Service Roles Azure Managed Identities and Service Principals GCP Workload Identity Kubernetes Service Accounts Experience with HashiCorp Vault or other enterprise secrets-management platforms. Experience with OAuth 2.0, OpenID Connect, SAML, JWTs, API authentication, PKI, certificates, and SSH. Familiarity with NHI attack paths, identity-based attack techniques, credential theft, secret leakage, and machine-to-machine authentication risks. Experience with scripting and automation using Python, PowerShell, REST APIs, or similar technologies. Experience creating NHI risk models, security metrics, dashboards, and executive reporting. Relevant certifications such as CISSP, CCSP, Security+, cloud security certifications, or IAM/PAM certifications. Experience with emerging AI agent identities and AI workload security, including governance of credentials and permissions used by AI agents and autonomous workloads. Travel Requirements: Up to 10% travel Physical Requirements: Sedentary work Substantial movement of the wrists, hands, and/or fingers for a minimum of 8 hours a day Required to have close visual acuity to view computer terminal and/or extensive reading for a minimum of 8 hours a day We use Greenhouse Software as our applicant tracking system and Zoom Scheduler for HR screen request scheduling. At times, your email may block our communication with you. Please be sure to check your SPAM folder so that you don’t miss updates on your application. Why GuidePoint? GuidePoint Security is a rapidly growing, profitable, privately-held value added reseller that focuses exclusively on Information Security. Since its inception in 2011, GuidePoint has grown to over 1,300 employees, established strategic partnerships with leading security vendors, and serves as a trusted advisor to more than 6,200 customers. Firmly-defined core values drive all aspects of the business, which have been paramount to the company’s success and establishment of an enjoyable workplace atmosphere. At GuidePoint, your colleagues are knowledgeable, skilled, and experienced and will seek to collaborate and provide mentorship and guidance at every opportunity. This is a unique and rare opportunity to grow your career along with one of the fastest growing companies in the nation. Some added perks…. Remote workforce primarily (U.S. based only, some travel may be required for certain positions, working on-site may be required for Federal positions) Group Medical Insurance options: Zero Deductible PPO Plan (GuidePoint pays 90% of the premium for employees and 70% for family plans (spouse/children/family) or High Deductible Health Plan with HSA (GuidePoint pays 100% of the employees premiums and 75% for family plans (spouse/children/family). If you choose the High Deductible / HSA plan, GPS will contribute in 4 equal quarterly installments: ($850 per EE annually / $1750 per family annually (includes spouse/children/family options) Group Dental Insurance: GuidePoint pays 100% of the premium for employees and 75% of family plans 12 corporate holidays and a Flexible Time Off (FTO) program Healthy mobile phone and home internet allowance Eligibility for retirement plan after 2 months at open enrollment Pet Benefit Option