Identity & Trust Service Manager

ROLE PURPOSE

Verisure protects millions of families and businesses through connected devices, cloud platforms and a 24/7 operation. Trust in every person, machine, device and secret that touches that service is a core security capability, not a supporting function.

The Identity & PKI Manager is accountable end to end for that capability. The role owns the strategy, design, operation and commercial management of Verisure's identity and trust platforms, and leads a team of security engineers to deliver them as products with clear SLAs, measurable risk reduction and executive visibility.

KEY ACCOUNTABILITIES

1. Strategy and roadmap

- Define and deliver a multi-year Identity & Trust roadmap aligned with the Security strategy, Zero Trust principles and business priorities.

- Extend identity framework from people to non-human identities and AI agents under a single control model.

2. Unified IAM technical  lifecycle

- Onboard new systems under the unified IAM: establish SailPoint as the single authority for joiner-mover-leaver, and bring applications, platforms and business-owned systems under it through a standard onboarding model, connectors and acceptance criteria.

- Reduce the footprint of local administration: retire locally managed user provisioning and deprovisioning, shrink manual and delegated admin processes, and track coverage, orphaned accounts and provisioning time as board-level indicators.

- Maintain Entra ID as the secure corporate identity plane, including Conditional Access, PIM and passwordless authentication.

- Own privileged access (PAM) and secrets management as one continuum, from human administrators to machine and pipeline credentials.

3. PKI service design and management

- Trust architecture: own the design of the corporate and device PKI, including CA hierarchy, certificate profiles, certificate policy and practice statements, HSM and key custody, and key ceremonies.

- Device PKI at scale: design and run the identity and certificate lifecycle for connected devices, from factory provisioning through enrolment, renewal and revocation, in partnership with Product, Engineering and manufacturing partners.

- Service model: define the PKI service catalogue, SLAs, ownership and operating procedures; set the standards for certificate usage across the company.

4. Operations, platform maintenance and resilience

- Guarantee availability, performance and security of all platforms in scope, with disciplined incident, problem and change management.

- Platform maintenance: own the full platform lifecycle: patching, upgrades, version currency, capacity, connector health, licence management, technical debt and end-of-life planning.

- Ensure tested disaster recovery for critical services: CA hierarchy, device certificate issuance, privileged vaults and secrets stores.

- Run the domain through KPIs and KRIs: IAM coverage, PAM coverage, expired certificates, secret rotation, provisioning time, platform currency and audit findings.

5. Vendor and partner management

- Manage manufacturers, integrators and managed service providers: contracts, SLAs, renewals, roadmap alignment and performance.

6. Leadership of the security engineering team

- Lead, develop and retain a team of security engineers; define roles, career paths and capacity plans.

- Drive a product-based, automation-first and DevSecOps operating model, in line with the domain-based organisation of Security Architecture and Engineering.

PROFILE

Essential

- Degree in Computer Science, Telecommunications Engineering or equivalent; a master's in cybersecurity is a plus.

- 5+ years in cybersecurity or IT, including 3+ years leading technical teams.

- Proven experience in at least three of: IGA, Entra ID, PKI, PAM, secrets management.

- Track record owning a service end to end: roadmap, design, operations, budget and suppliers.

- Executive communication in English and Spanish.

Valued

- Device PKI at scale in IoT or industrial environments.

- Experience driving enterprise-wide IAM consolidation and decommissioning of local admin processes.

- Non-human identity, AI agent identity and modern authorisation models.

- CISSP, CISM, CCSP, or SailPoint, Microsoft or CyberArk certifications.

- Multinational, regulated or critical-infrastructure environments.