6 months ago
Remote, United StatesStaff+
Responsibilities
- Own application and software security, including SAST, DAST, SCA, secure SDLC, threat modeling, and vulnerability management.
- Harden GitLab CI/CD pipelines and software supply-chain controls, including build provenance, dependency integrity, signing, and SLSA-aligned controls.
- Secure GKE and Kubernetes product infrastructure through container security, workload identity, network policy, runtime protection, and hardened baselines.
- Design and operate product PKI, including certificate issuance, lifecycle management, rotation, key management, and mTLS architecture.
- Lead vulnerability triage, prioritization, remediation tracking, exception handling, and product-side incident response.
- Partner with hardware and firmware teams on secure boot, key storage, firmware security, and hardware supply-chain integrity.
- Build security tooling and automation with Python, Bash, Go, Terraform, and scripts.
- Mentor engineers, lead architecture reviews, write security documentation, and translate compliance controls into engineering work.
Requirements
- Senior- or staff-level hands-on experience in product security or security engineering with significant software and AppSec depth.
- Production experience securing cloud environments, including IAM, organization policy, VPC Service Controls, KMS, and Kubernetes.
- Strong cryptographic foundations and experience with PKI architecture, key management, signing, mTLS, and secrets handling at scale.
- Hands-on coding ability in Python, Bash, and Go, with the ability to ship tooling, Terraform, and scripts.
- Experience building security programs, leading product incident response, coordinating with engineering teams, and owning post-mortems.
- Experience mentoring engineers and raising the security standards of teams, including without direct reports.
- Experience interfacing with hardware and firmware teams and strong written communication skills.
- Working knowledge of CMMC, FedRAMP, and DFARS compliance frameworks.
- Preferred experience with NIST 800-53, NIST 800-171, DoD SRG environments, government-cloud platforms, HSMs, TPMs, secure elements, supply-chain attestation, embedded or firmware security, secure boot, RoT, OTA update integrity, vulnerability disclosure programs, bug bounties, and CVE coordination.
- Applicants must satisfy the stated U.S. export-control access requirements or be eligible and reasonably likely to obtain the necessary export authorization.
Benefits
- Flexible working arrangements, including hybrid remote/in-office schedules.
- Comprehensive benefits including 401(k), dental, vision, health, and life insurance.
- Paid time off and equity options.
- Professional development and career advancement opportunities.
- Collaborative, inclusive work environment focused on aerospace communications and national security programs.
Tech Stack
Categories
About Aalyria
Aalyria builds networking technologies for operating high-throughput, moving networks across land, sea, air, and space. Its products include Tightbeam, an ultra-high-speed free-space optical communications system, and Spacetime, a platform-as-a-service for modeling, planning, and orchestrating dynamic networks for commercial and government operators. Privately held and headquartered in Livermore, California, Aalyria originated from technologies developed at Alphabet and serves aerospace, telecommunications, and national security markets.