5 days ago
Base Salary
$142k - $238k/yr
Responsibilities
- Define end-to-end security architecture for avionics and avionics-adjacent systems, including threat modeling, security zoning, trust boundaries, and data-flow protections.
- Lead airworthiness security risk assessments, including scope definition, threat scenario analysis, and Security Assurance Level determination.
- Architect and validate SAL 2 controls and produce security evidence for certification authorities and customers.
- Ensure security measures align with safety objectives and justify the security posture of lower-assurance components and their interfaces to higher-DAL systems.
- Design and harden bare-metal Linux deployments using secure boot, kernel hardening, SELinux/AppArmor policies, minimal attack-surface images, disk encryption, TPM integration, and secure updates.
- Architect Kubernetes security for on-premises environments, including access control, network policy, admission control, pod security, secrets management, image signing, runtime threat detection, and tenant isolation.
- Define cryptographic architecture covering key management, PKI, certificate lifecycle, TLS/mTLS communications, and data-at-rest protection.
- Establish secure SDLC and supply-chain practices involving SBOMs, dependency and container scanning, signed artifacts, and build-pipeline integrity.
- Conduct architecture and design reviews and advise on penetration testing, vulnerability management, and incident response planning.
- Mentor engineers and communicate security risks to technical and executive audiences.
Requirements
- 8+ years of software development experience with a master’s or PhD, 10+ years with a bachelor’s degree, or 14+ years of related software development experience in lieu of a degree.
- Hands-on experience with Security Assurance Level assignment and security assurance evidence.
- Deep experience securing bare-metal Linux systems, including hardening, boot-chain integrity, and kernel and userspace controls.
- Strong Kubernetes security experience, including CIS benchmarks, OPA/Gatekeeper or Kyverno, service mesh, and runtime security tooling.
- Proficiency in threat-modeling methodologies.
- Strong knowledge of applied cryptography, PKI, and network security architecture.
- Excellent written communication and ability to author certification-grade security documentation.
- Preferred familiarity with ARINC 811, ARINC 429, and avionics data-bus security.
- Preferred experience with NIST SP 800-53/800-82, ISO/IEC 27001, Common Criteria, or IEC 62443.
- Preferred experience with hardware roots of trust, secure enclaves, or hardware security modules.
- Preferred experience with DevSecOps toolchains and infrastructure as code using Terraform, Ansible, or Helm.
- Relevant preferred certifications include CISSP, CISSP-ISSAP, CCSP, CKS, or GIAC certifications such as GCSA or GDSA.
- Prior interaction with FAA or EASA certification authorities on security matters is preferred.
Benefits
- Unlimited PTO for exempt salaried employees, company-paid holidays, and a paid U.S. company-wide shutdown between Christmas and New Year.
- Medical coverage through Aetna or Kaiser, dental and vision insurance, and flexible employee or family coverage options.
- 401(k) with a 50% match on contributions up to 8%, fully vested from day one.
- Additional offerings include wellness and counseling programs, FSA/HSA, life and disability insurance, legal and pet insurance, education assistance, commuter benefits, and an employee purchase program.