Staff Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Develop and enhance trust architecture that links devices, customers, and the cloud platform.

• Design and manage PKI on GCP, which includes offline root, HSM-backed issuing CAs, certificate profiles, and key ceremonies.

• Establish device identity, factory provisioning, field enrollment, rotation, revocation, and responses to CA key compromises.

• Architect identity solutions for workforce, workload, and customers utilizing SSO, Workforce Identity Federation, OAuth 2.0, and OIDC.

• Secure device-to-cloud communications through mutual TLS, per-device authorization, and safeguards against replay attacks, cloned devices, and fleet-wide denial of service attacks.

• Take ownership of the security for the GCP ingestion layer utilizing MQTT brokers and gateways on GKE that feed into Pub/Sub, Dataflow, and BigQuery.

• Ensure the security of remote commands and over-the-air updates.

• Define on-device security standards, including secure boot, signed and rollback-protected firmware, encrypted storage, locked debug ports, and hardened OS images.

• Conduct hands-on analysis of firmware, hardware, and local-interface attacks, protocol fuzzing, and mobile app security assessments.

• Oversee the firmware supply chain, involving SBOMs, vulnerability management, signing-key custody, and vendor assessments.

• Create threat models and perform penetration tests, as well as red-team and purple-team exercises.

• Establish GCP guardrails across organizational policy, VPC Service Controls, IAM, Cloud KMS, GKE, Binary Authorization, CI/CD, and data pipelines.

• Align controls with ISO 27001, SOC 2, NIST CSF, CIS Controls, ETSI EN 303 645, NIST IR 8259, GSMA baseline controls, and FCC CPNI regulations.

• Act as an escalation point for security decisions and incidents, mentor senior engineers, and provide briefings to executives.

⛳️ Requirements

• Bachelor's or Master's degree in computer science, information security, cryptography, or equivalent experience.

• Over 10 years of experience in security engineering.

• Strong ownership of at least two of the following areas: PKI, identity and access management, device security, or cloud security architecture.

• Expertise in PKI, including X.509 profiles, CA hierarchy design, HSM and key management, certificate lifecycle automation, revocation at scale, and protocols like EST, SCEP, and ACME.

• Familiarity with GCP Certificate Authority Service or a similar managed CA.

• Proficiency in identity management, including OAuth 2.0, OIDC, SAML, SSO, and federation.

• Experience with running or integrating an enterprise Identity Provider (IdP).

• Knowledge in designing token and session security for applications and devices.

• Extensive GCP security experience, including IAM, Workload Identity Federation, Cloud KMS, VPC Service Controls, GKE and container security, Security Command Center, BigQuery, Dataflow, Datastream, and Kafka.

• Understanding of mutual TLS, MQTT and gRPC security, broker and gateway hardening, and OTA update integrity.

• Practical skills in device and embedded security, including secure boot, TPM or secure element usage, firmware analysis, hardware debug interfaces, and mobile app security for Android and iOS.

• Proficient in offensive security techniques and capable of threat-modeling an entire device-to-cloud system.

• Ability to develop tools in Python, Go, or similar programming languages.

• Experience with CI/CD processes and DevSecOps security.

• Familiarity with ISO 27001, SOC 2, NIST CSF, and CIS Controls.

• Proven record of influencing architecture across multiple teams.

• Exceptional writing and briefing abilities.

🏝️ Benefits

• Competitive benefits and vacation package.

• Opportunity to engage in cutting-edge projects that affect millions of users.

• Collaborative culture that promotes continuous learning and growth.

• Potential eligibility for a bonus.