Staff Information Security Engineer

Why UKG:    

At UKG, the work you do matters. The code you ship, the decisions you make, and the care you show a customer all add up to real impact. Today, tens of millions of workers start and end their days with our workforce operating platform. Helping people get paid, grow in their careers, and shape the future of their industries. That’s what we do.  

We never stop learning. We never stop challenging the norm. We push for better, and we celebrate the wins along the way. Here, you’ll get flexibility that’s real, benefits you can count on, and a team that succeeds together. Because at UKG, your work matters—and so do you.  

About the team

UKG is seeking a Staff Information Security Engineer to join our Enterprise Identity and Access Management (IAM) team within Global Security. You’ll work with Security Engineering, Cloud Engineering, Platform Engineering, Infrastructure Engineering, and application teams to secure machine identities, certificates, secrets, and access across UKG’s enterprise and cloud environments.

About the role

As a Staff Information Security Engineer, you'll play a key role in designing, maintaining, and modernizing enterprise security infrastructure with a strong focus on DevOps/DevSecOps engineering, secrets management, certificate lifecycle management, and cloud security platforms.

You'll support highly available HashiCorp Vault and Consul environments while helping advance UKG's transition toward cloud-native secrets management solutions, including Google Secret Manager within GCP. This is a highly hands-on position requiring strong infrastructure troubleshooting, automation, scripting, and technical problem-solving skills.

You'll work closely with engineering teams to improve platform reliability, scalability, observability, and operational efficiency while contributing to security infrastructure modernization initiatives.

In this role, you will:

• Administer, maintain, and troubleshoot enterprise HashiCorp Vault and Consul environments, including cluster management, high availability, disaster recovery, and operational reliability.
• Support the modernization of enterprise secrets management infrastructure, including the transition from HashiCorp Vault to Google Cloud Secret Manager within GCP.
• Design, implement, and maintain infrastructure automation using Terraform, Python, PowerShell, GitHub Actions, REST APIs, and cloud-native technologies, including reusable modules, deployment workflows, and automated response capabilities.
• Manage and support cloud-based security infrastructure, particularly within GCP and AWS, including secrets management, access infrastructure, and service identities.
• Design, administer, and automate enterprise certificate lifecycle management and PKI solutions, including issuance, renewal, rotation, revocation, and troubleshooting.
• Troubleshoot complex infrastructure, authentication, authorization, secrets management, and certificate-related issues across enterprise and cloud environments.
• Implement and maintain observability, monitoring, and alerting solutions to improve infrastructure reliability, operational visibility, and incident response.

About you 

Basic qualifications:

• 8+ years of hands-on experience in DevOps, DevSecOps, security engineering, cloud engineering, platform engineering, infrastructure engineering, or a related technical field.
• Experience administering, troubleshooting, and supporting enterprise HashiCorp Vault environments, including highly available production deployments.
• Experience managing enterprise security infrastructure, including secrets management platforms, certificate management, PKI, or secure access infrastructure.
• Strong hands-on experience developing Infrastructure as Code using Terraform and implementing automation through Python, PowerShell, or similar scripting languages.
• Experience deploying, configuring, and supporting infrastructure in cloud environments such as GCP or AWS.
• Experience supporting highly available enterprise platforms, including troubleshooting, disaster recovery, reliability, and operational monitoring.
• Familiarity with HashiCorp Consul, cloud-based secrets management solutions, and secure authentication and authorization patterns.
• Experience with REST APIs, system integrations, CI/CD workflows, and infrastructure automation.
• Strong analytical, debugging, problem-solving, and cross-functional collaboration skills.

Preferred qualifications:

• Experience with GCP Google Secret Manager, AWS Secrets Manager, or similar cloud-native secrets management platforms.
• Experience migrating or modernizing enterprise secrets management infrastructure.
• Advanced experience with HashiCorp Vault and Consul, including enterprise-scale clusters, high availability, and disaster recovery.
• Experience administering enterprise PKI environments and automating certificate issuance and renewal using ACME or similar protocols.
• Experience with machine identities, service accounts, Workload Identity Federation (WIF), and keyless authentication.
• Experience with Kubernetes, containerized workloads, and cloud-native infrastructure.
• Experience implementing observability, monitoring, and alerting using Grafana, Prometheus, PagerDuty, or similar technologies.
• Experience designing reusable Terraform modules and automation frameworks to improve infrastructure reliability and operational efficiency.
• Experience establishing technical standards, influencing architectural decisions, and mentoring other engineers.

Company Overview:  

UKG is the Workforce Operating Platform that puts workforce understanding to work. With the world's largest collection of workforce insights, and people-first AI, our ability to reveal unseen ways to build trust, amplify productivity, and empower talent, is unmatched. It's this expertise that equips our customers with the intelligence to solve any challenge in any industry — because great organizations know their workforce is their competitive edge. Learn more at ukg.com.  

Equal Opportunity Employer     

UKG is an equal opportunity employer. We evaluate qualified applicants without regard to race, color, disability, religion, sex, age, national origin, veteran status, genetic information, and other legally protected categories.  

View The EEO Know Your Rights poster       

UKG participates in E-Verify. View the E-Verify posters here.   

It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.  

Disability Accommodation in the Application and Interview Process 

For individuals with disabilities that need additional assistance at any point in the application and interview process, please email [email protected].  

The pay range for this position is $115,100 to $165,450. The actual base pay offered may vary depending on skills, experience, job-related knowledge and work location. In addition to base pay, employees may be eligible to participate in a performance-based bonus plan and to receive restricted stock unit awards as part of total compensation. Learn more about UKG’s benefits and rewards at https://www.ukg.com/about-us/careers/benefits