Staff Platform Engineer, Security

Responsibilities

• Build cloud security tooling, automation, services, CLI utilities, dashboards, and secure patterns for engineering teams.
• Implement and maintain security controls across Azure and AWS, including IAM, networking, encryption, monitoring, and secure-by-default infrastructure.
• Operate PKI infrastructure, including AWS Private CA, AD CS, certificate lifecycle management, mTLS, and load balancer certificate management.
• Operate HashiCorp Vault, including its PKI engine, dynamic secrets, authentication methods, and policy management.
• Partner with Kubernetes security teams on PKI, IAM integration, network policies, node security, and CSI driver security.
• Design and troubleshoot multi-account and multi-VPC network topologies across cloud environments.
• Execute CSPM, threat detection, incident response, and security policy enforcement projects.
• Improve security in infrastructure-as-code, CI/CD pipelines, and deployment processes while partnering with engineering teams on secure architectures.
• Build security testing tools and continuously validate cloud security controls.
• Participate in on-call rotation for security incident response and mission-critical support as needed.

Requirements

• Active security clearance or ability to obtain and maintain one.
• 10+ years of technical experience, including securing production cloud environments at scale across Azure and AWS.
• Strong software development skills in Python and/or Go, with experience building security tooling and automation.
• Strong software engineering fundamentals, including data structures, algorithms, API design, debugging production systems, and working across multiple languages.
• Strong Terraform skills, including module design and infrastructure-as-code security best practices.
• Experience building security tooling or automation used by engineering teams.
• Strong cloud networking and troubleshooting experience across AWS and Azure, including VPCs/VNets, subnets, NACLs/NSGs, Security Groups, Transit Gateways/Virtual WAN, VPC peering, route tables, and VPN/ExpressConnect.
• Hands-on experience with CSPM, CWPP, SIEM, Terraform, and CloudFormation.
• Strong knowledge of IAM, encryption, logging/monitoring, and cloud-native security patterns.
• Experience embedding security into development and operations workflows and executing complex security projects.
• Strong PKI knowledge, including certificate lifecycle management, mTLS, certificate-based authentication, and X.509/TLS troubleshooting.
• Preferred production experience operating HashiCorp Vault, including Vault PKI, dynamic secrets engines, authentication methods, and integrations with Kubernetes, AWS, and Azure.
• Ability to work across unfamiliar codebases, use AI tools to accelerate development, assess risk, prioritize work, and collaborate effectively.
• Eligibility under applicable U.S. Government space technology export regulations, including ITAR.

Benefits

• Equity and health, dental, vision, HRA/HSA, PTO, paid holidays, 401(k), and parental leave benefits.
• Onsite work in Denver, Colorado, or Long Beach, California, with a minimum expectation of three days per week in the office.
• Possible on-call rotation for security incidents and mission-critical system support.
• Occasional travel to government sites, launch facilities, or partner locations may be required.