Base Salary
$136k - $266k/yr
Responsibilities
- Design and operate GCP PKI with offline roots, HSM-backed issuing CAs, certificate profiles, lifecycle automation, and key ceremonies.
- Define device identity, provisioning, enrollment, rotation, revocation, and recovery plans for CA key compromise.
- Architect workforce, workload, customer, application, and device identity using federation and modern authentication protocols.
- Secure device-to-cloud communications, remote commands, OTA updates, mobile applications, gateways, brokers, and ingestion systems.
- Establish on-device security requirements including secure boot, signed firmware, encrypted storage, locked debug ports, and hardened operating system images.
- Perform firmware analysis, hardware and local-interface testing, protocol fuzzing, penetration testing, red-team exercises, and purple-team exercises.
- Govern firmware supply-chain security, including SBOMs, vulnerability management, signing-key custody, and vendor assessments.
- Build threat models for device, application, gateway, and cloud systems and establish GCP security guardrails.
- Map security controls to ISO 27001, SOC 2, NIST CSF, CIS Controls, ETSI EN 303 645, NIST IR 8259, GSMA baseline controls, and FCC CPNI rules.
- Serve as an escalation point for security decisions and incidents, influence cross-team architecture, mentor engineers, and brief executives.
Requirements
- Bachelor's or master's degree in computer science, information security, or cryptography, or equivalent experience.
- 10+ years of security engineering experience with deep ownership in at least two of PKI, identity and access, device security, or cloud security architecture.
- Deep PKI experience including X.509 profiles, CA hierarchy design, HSM and key management, certificate lifecycle automation, revocation at scale, EST, SCEP, ACME, and managed certificate authorities.
- Deep identity experience with OAuth 2.0, OIDC, SAML, SSO, federation, enterprise identity providers, and token and session security.
- Strong GCP security experience covering IAM, Workload Identity Federation, Cloud KMS, VPC Service Controls, GKE, container security, Security Command Center, and data pipelines.
- Experience securing device-to-cloud communications with mutual TLS, MQTT, gRPC, broker and gateway hardening, and OTA update integrity.
- Hands-on device and embedded security experience with secure boot, TPM or secure elements, firmware analysis, hardware debug interfaces, and Android and iOS mobile application security.
- Hands-on offensive security and threat-modeling experience for full device-to-cloud systems, plus ability to write tooling in Python, Go, or similar.
- Experience with CI/CD, DevSecOps security, ISO 27001, SOC 2, NIST CSF, and CIS Controls.
- Demonstrated ability to influence architecture across multiple teams, communicate clearly in writing, and brief executives.
Benefits
- Remote role as indicated by the #LI-Remote designation.
- Competitive benefits and vacation package.
- Opportunity to work on projects impacting millions of users and participate in continuous learning and growth.
- May be eligible for a bonus as part of total compensation.
Tech Stack
About Calix
Calix is an AI platform company that enables service providers to transform their operations and accelerate delivery of differentiated experiences—so they can compete and win in the markets and communities they serve. Through the AI-native Calix One platform, service providers can securely and privately activate agentic-AI alongside their human teams to acquire new subscribers, grow existing subscriber revenue, and build loyalty across residential, business, municipal, and MDU markets. More than 1,200 customers of all sizes leverage the Calix One platform, which has evolved over 15 years at an investment of more than $2 billion. Calix innovation cycles are underpinned by a strong financial balance sheet and a people‑first culture that routinely earns broad industry recognition—winning 81 culture and innovation awards since 2025 alone, as well as Fortune’s 100 Best Companies to Work For® in 2026.