FactSet creates flexible, open data and software solutions for over 200,000 investment professionals worldwide, providing instant access to financial data and analytics that investors use to make crucial decisions.
At FactSet, our values are the foundation of everything we do. They express how we act and operate , serve as a compass in our decision-making, and play a big role in how we treat each other, our clients, and our communities. We believe that the best ideas can come from anyone, anywhere, at any time, and that curiosity is the key to anticipating our clients’ needs and exceeding their expectations.
Your Team’s Impact
In this role, you will Join our Zero‑Trust Service Identity team to define and deliver the standard for service‑to‑service authentication across internal APIs. You will lead the design and rollout of SPIFFE/SPIRE as the organization’s identity plane, enabling strong, workload‑based identity with mTLS (X.509 SVIDs) and JWT‑SVIDs. This role spans architecture, implementation, automation, and operations—establishing HA/SPoF‑free deployments, integrating with enterprise PKI/HSM, building verifier libraries for Java/Go/.NET, and enabling rapid adoption through self‑service tooling and golden templates.
What You’ll Do
- Design and deploy highly available SPIRE across dev/stage/prod, integrated with Security PKI/HSM as the upstream CA.
- Implement end‑to‑end service authentication: mTLS using X.509 SVIDs and JWT‑SVID support with JWKS publishing and trust bundle management.
- Build and maintain verifier libraries/SDKs for Java, Go, and .NET with efficient caching, robust validation, and clock‑skew handling; provide samples and integration guides.
- Define and standardize caller identity propagation
- Implement node and workload attestors for Kubernetes and VM environments; ensure secure bootstrap and attestation policies.
- Automate deployments and operations with IaC and CI/CD (e.g., Terraform/CloudFormation, Helm, GitHub Actions/Jenkins), including canary/blue‑green strategies and signed artifacts.
- Deliver zero‑downtime rotation for certificates, trust bundles, and JWKS; establish certificate/key lifecycle processes and guardrails.
- Plan and execute DR/HA: multi‑region topologies, health checks, failover procedures, backup/restore runbooks, and chaos/DR drills.
- Build developer enablement: self‑service portal/CLI, golden templates/Helm charts, linters/policy checks, and migration tooling from legacy mTLS/API keys.
- Own operational excellence: patching/upgrade schedules, scaling policies and capacity planning, on‑call runbooks and incident/rollback playbooks.
- Participate in code-reviews and proactively take ownership of PR’s and make sure to catch all security vulnerabilities
- Proper collaboration and interaction with multiple teams across FactSet and respond to stake holder queries in a timely manner
What We’re Looking For
- Bachelor’s degree, or higher, in Computer Science or a related technical field
- 6+ years of experience building backend/platform/security systems, with a focus on service identity, PKI, or zero‑trust architectures.
- Hands‑on experience with SPIFFE/SPIRE or equivalent workload identity systems (e.g., Envoy/Istio SDS, strong mTLS at scale) .
- Strong grasp of X.509, PKI/CA hierarchies, certificate issuance/renewal, revocation, trust stores, and JWKS/JWT (JWS/JWK).
- Proficiency in at least two of: Go, Java, .NET
- Kubernetes production experience (networking, RBAC, admission/attestors) and Docker/containers proficiency.
- Infrastructure‑as‑code and CI/CD pipelines
- Strong AWS fundamentals (EKS, EC2, VPC, IAM, KMS/CloudHSM or HSM integrations), Linux debugging, and performance tuning.
- Security‑first mindset with practical knowledge of mTLS, least‑privilege, secrets management, and auditability.
- Clear communication, systems thinking, and end‑to‑end ownership from design through operations.
Address production issues in a timely manner
-
Nice to have:
- Experience with enterprise PKI, HSMs, or CA integrations; cert‑manager/Vault.
- Policy enforcement integrations (OPA/Rego, Envoy ext_authz) and identity‑aware authorization patterns.
- Multi‑region reliability engineering, traffic management, and chaos/DR testing.
- Observability stacks (OpenTelemetry, Prometheus, Grafana, ELK/Loki) and SLO/error budget management.
What's In It For You
At FactSet, our people are our greatest asset, and our culture is our biggest competitive advantage. Being a FactSetter means:
The opportunity to join an S&P 500 company with over 45 years of sustainable growth powered by the entrepreneurial spirit of a start-up.
Support for your total well-being. This includes health, life, and disability insurance, as well as retirement savings plans and a discounted employee stock purchase program, plus paid time off for holidays, family leave, and company-wide wellness days.
Flexible work accommodations. We value work/life harmony and offer our employees a range of accommodations to help them achieve success both at work and in their personal lives.
A global community dedicated to volunteerism and sustainability, where collaboration is always encouraged, and individuality drives solutions.
Career progression planning with dedicated time each month for learning and development.
Business Resource Groups open to all employees that serve as a catalyst for connection, growth, and belonging.
Learn more about our benefits here .
Salary is just one component of our compensation package and is based on several factors including but not limited to education, work experience, and certifications.
FactSet ( NYSE:FDS | NASDAQ:FDS ) helps the financial community to see more, think bigger, and work better. Our digital platform and enterprise solutions deliver financial data, analytics, and open technology to more than 8,200 global clients, including over 200,000 individual users. Clients across the buy-side and sell-side, as well as wealth managers, private equity firms, and corporations, achieve more every day with our comprehensive and connected content, flexible next-generation workflow solutions, and client-centric specialized support. As a member of the S&P 500, we are committed to sustainable growth and have been recognized among the Best Places to Work in 2023 by Glassdoor as a Glassdoor Employees’ Choice Award winner. Learn more at www.factset.com and follow us on X and LinkedIn .
At FactSet, we celebrate difference of thought, experience, and perspective. Qualified applicants will be considered for employment without regard to characteristics protected by law.
