3 hours ago
Remote, United StatesStaff+
Responsibilities
- Build authentication and authorization systems, including token validation, trust anchors, principal namespaces, permission models, delegation, multi-tenancy, machine-to-machine access, and break-glass access.
- Own authentication SDKs, PKI, certificate authorities, issuance and revocation policies, workload identity, secrets and key access models, and client libraries.
- Design audit and structured logging schemas that make authorization decisions reconstructable and usable as evidence in regulated and classified environments.
- Set security standards for hardened images, service mesh policy, supply-chain security, and pipeline gates in partnership with infrastructure and developer platform teams.
- Operate production security systems, including availability, upgrades, security maintenance, and incident response.
- Threat-model distributed systems and build mitigations that address classes of vulnerabilities.
- Set technical direction across teams through design documents, decision-making, cross-team collaboration, and adoption without direct authority.
- Mentor engineers and improve the quality of design and code reviews.
- Translate product-engineering requirements into security capabilities that teams can adopt independently.
Requirements
- 10+ years of backend software engineering experience on production services, including ownership of systems other teams depend on.
- Deep experience in Go, or deep backend experience in a comparable language with readiness to work in Go daily.
- Built or served as a core contributor and design owner for an authentication or authorization system, identity-provider integration, certificate authority, or secrets/key-management service.
- Firsthand experience with token-based authentication failure modes, including audience confusion, unverified issuers, key confusion, and redirect handling at token endpoints.
- Working knowledge of Kubernetes and cloud infrastructure.
- Experience setting technical direction across teams, writing design documents, driving decisions to closure, and earning adoption without direct authority.
- Experience mentoring engineers and raising design and code-review quality.
- Preferred: experience with regulated, disconnected, or high-assurance environments.
- Preferred: experience integrating or operating OIDC providers such as Zitadel, Keycloak, Okta, Auth0, or comparable systems.
- Preferred: experience with authorization at scale, policy engines, RBAC or ReBAC models, or fine-grained permission services.
- Preferred: experience with SPIFFE/SPIRE, Vault, cloud KMS, or HSM-backed key management.
- Preferred: experience with audit logging or evidence generation for FedRAMP, DoD Impact Levels, or comparable regimes.
- Preferred: experience setting infrastructure security standards and threat-modeling distributed systems.
- Bachelor’s degree in Computer Science or a related technical field, or equivalent practical experience.
- Applicants must satisfy one of the stated U.S. export-control eligibility or authorization criteria for access to export-controlled information.
Benefits
- Flexible working arrangements, including hybrid remote/in-office schedules.
- Professional development and career advancement opportunities.
- Comprehensive benefits including 401(k), dental, vision, health, life insurance, and paid time off.
- Equity options.
- Work contributing to aerospace communications and critical national security programs.
Tech Stack
About Aalyria
Aalyria builds networking technologies for operating high-throughput, moving networks across land, sea, air, and space. Its products include Tightbeam, an ultra-high-speed free-space optical communications system, and Spacetime, a platform-as-a-service for modeling, planning, and orchestrating dynamic networks for commercial and government operators. Privately held and headquartered in Livermore, California, Aalyria originated from technologies developed at Alphabet and serves aerospace, telecommunications, and national security markets.