NHI and Machine Identity Engineer Career Guide: Skills, Routes and Certifications for the Role

Service accounts, API keys, OAuth clients, certificates, workload identities and now AI agents outnumber human users in most estates, yet few organisations have anyone whose job is to own them. The NHI or machine identity engineer is the role that fills that gap: part identity engineer, part platform engineer, part secrets and PKI specialist. This guide explains what the role does day to day, the skills and tools it needs, the routes people take into it, which certifications help (with facts checked against the certifying bodies' own pages on 27 October 2026), and how it progresses. It is for IAM, cloud, DevOps and security engineers considering the move, and for managers writing the job description. For the wider career landscape, see the Cybersecurity Careers Guide.

Key takeaways

• The role owns identities that have no human owner by default. The core job is discovery, ownership, least privilege, rotation and decommissioning for non-human identities, the problems the OWASP Non-Human Identities Top 10 2025 lists.
• It sits between IAM and platform engineering. You need identity fundamentals (authentication, authorisation, federation, lifecycle) and enough cloud, Kubernetes and CI/CD knowledge to change how workloads get credentials.
• The direction of travel is away from static secrets. Much of the work is replacing long-lived keys with short-lived, attested credentials such as cloud workload identity federation and SPIFFE SVIDs.
• There is no single NHI certification path yet. Combine an identity credential, a cloud or Kubernetes security credential and hands-on secrets management skills; a portfolio of real migrations matters more than any one exam.
• AI agents are extending the role. Agents act with delegated credentials and tokens, so NHI engineers are increasingly asked to design agent identity, scoping and audit.

What the role does

Titles vary: NHI engineer, machine identity engineer, workload identity engineer, secrets management engineer, or a senior IAM engineer with an NHI remit. The work is broadly the same.

A typical week mixes engineering (writing Terraform or policy, building a rotation pipeline), investigation (a leaked key alert, an unknown service account with administrator rights) and negotiation (persuading an application team to move off a shared key). For the full domain, see the Non-Human Identity (NHI) Guide.

Where the role sits in the organisation

Most NHI engineers sit in one of three places: the identity team (alongside workforce IAM and privileged access), the cloud or platform security team, or a central secrets and PKI platform team. Each placement changes the work. In an identity team the emphasis is governance: ownership, attestation, offboarding and reporting. In a platform team it is engineering: federation, rotation pipelines and paved roads for developers. Whichever team you join, expect to work closely with privileged access management, because many NHIs carry administrator rights, and with incident response, because leaked secrets are among the most frequent identity incidents. See the NHI Ownership Guide.

AI agents and the expanding scope

AI agents authenticate with the same building blocks as other workloads: OAuth clients, API keys, delegated user tokens and service accounts. What changes is that an agent chooses its own actions, so scoping, approval for high-impact actions and audit of what the agent did on whose behalf become identity design questions. NHI engineers are increasingly asked to register agents as identities, issue them short-lived scoped credentials, keep secrets out of prompts and tool configurations, and make sure every action can be traced to both the agent and the human principal. See the Credential Vaulting for AI Agents Guide.

Core skills and tools

Identity fundamentals

• Protocols: OAuth 2.0 grant types (especially client credentials and token exchange), OpenID Connect, JWT validation, SAML for the human side, mutual TLS.
• Lifecycle: joiner, mover, leaver thinking applied to workloads: creation, ownership, review, rotation and decommissioning. See the NHI Offboarding and Decommissioning Guide.
• Authorisation models: role-based and attribute-based access, policy as code, and how cloud IAM policies are evaluated.

Platform and cloud

• Cloud IAM: AWS IAM roles and STS, Azure managed identities and service principals, Google Cloud service accounts and workload identity federation. See the Cloud Workload Identity Guide.
• Kubernetes: service accounts, projected tokens, RBAC and admission control. See the Kubernetes NHI Security Guide.
• CI/CD: OIDC federation from pipelines to cloud, runner security and pipeline secrets.
• Infrastructure as code: Terraform or equivalent, because NHI fixes are usually delivered as code changes.

Secrets, PKI and workload identity

• Secrets managers: a vault or cloud secrets service, dynamic secrets, leasing and rotation. See the Secrets Management Guide.
• PKI: certificate issuance, ACME automation, private CAs and certificate inventory. See the Machine Identity, PKI and Certificate Lifecycle Guide.
• SPIFFE and SPIRE: SPIFFE defines short-lived identity documents (X.509-SVIDs and JWT-SVIDs) issued to workloads through the Workload API; SPIRE is the open-source implementation. See the SPIFFE and SPIRE Guide.
• Emerging standards: the IETF WIMSE (Workload Identity in Multi System Environments) working group is chartered to standardise workload tokens and token exchange across systems; its documents are drafts and will change.

Working skills

• Scripting: Python, Go or PowerShell to query APIs and automate discovery and rotation.
• Data: joining logs, inventories and ownership data to answer "who owns this and is it used?".
• Influence: most NHI fixes need another team to change its application; explaining risk and offering a paved road matters as much as technical skill.

Routes into the role

A practical way in is to take ownership of one NHI problem in your current job: inventory the service accounts in one cloud account, move one pipeline from static keys to OIDC federation, or set up secret scanning for one organisation. Document the before and after; that is the portfolio hiring managers ask about.

What hiring managers look for

• Evidence of a migration: a concrete account of moving workloads from static secrets to federation or short-lived credentials, including how you handled the teams that resisted.
• Debugging depth: the ability to explain why a token was rejected, how a cloud policy was evaluated or why a certificate chain failed.
• Risk judgement: knowing which of 10,000 service accounts to fix first, usually by privilege, exposure and whether anyone owns it. See the NHI Risk Scoring Guide.
• Incident experience: having handled a leaked key end to end: revoke, rotate, check usage logs, find the root cause and stop it recurring.
• Communication: writing a short standard or runbook that application teams actually follow.

Certifications that help

No vendor-neutral certification is dedicated to non-human identity alone. The credentials below cover parts of the role. Facts are from each body's own page, checked on 27 October 2026; check again before booking, as formats and prices change.

Cloud provider security certifications from AWS, Microsoft and Google add depth on each platform's identity model. For a wider comparison, see the Identity Certifications Guide, the Certified Kubernetes Security Specialist (CKS) Guide and the CCSK Certification Guide. Broader credentials such as CISSP help later for leadership roles; see the CISSP Certification Guide.

Progression

• NHI engineer: delivers discovery, rotation and migration work within a defined scope, such as one cloud or one platform.
• Senior or lead NHI engineer: designs the target architecture (federation, workload identity, secrets platform), sets standards such as naming and tagging, and leads cross-team migrations. See the Machine Identity Naming and Tagging Standard Template.
• Identity architect: owns human and non-human identity architecture together, including agent identity. See the Security Architect Career Guide.
• Head of identity or NHI programme lead: runs the programme, budget, metrics and maturity roadmap. The NHI Governance Maturity Model is a useful frame for that conversation.
• Adjacent moves: AI security engineering, where agent credentials and tool access are central. See the AI Security Engineer Career Guide.

Measures that show progress in the role, and make good interview material: percentage of NHIs with a named owner, number of static cloud keys removed, median age of secrets, percentage of pipelines using federation instead of stored keys, and mean time to revoke a leaked secret.

Practitioner checklist

• Learn OAuth 2.0 client credentials, token exchange, OIDC and mutual TLS well enough to explain and debug them.
• Get hands-on with one cloud's workload identity model and one secrets manager.
• Build a small lab: a Kubernetes cluster, a pipeline using OIDC federation, and a workload receiving SPIFFE SVIDs.
• Read the OWASP Non-Human Identities Top 10 2025 and map each risk to something in your own environment.
• Deliver one real NHI improvement at work and document the measurable result.
• Choose one identity credential and one cloud or Kubernetes credential, checking the current details on the official page.
• Follow IETF WIMSE and OAuth working group drafts for workload and agent identity, noting that drafts change.

Standards and references

• OWASP: Non-Human Identities Top 10
• SPIFFE: Overview
• IETF: Workload Identity in Multi System Environments (WIMSE) working group
• IDPro: CIDPRO certification
• HashiCorp: Security automation certifications
• Linux Foundation: Certified Kubernetes Security Specialist (CKS)
• Cloud Security Alliance: Certificate of Cloud Security Knowledge (CCSK)

Related NHI Mgmt Group resources: Non-Human Identity (NHI) Guide · Cybersecurity Careers Guide · IAM Engineer Career Guide · Identity Certifications Guide