Principal Engineer, Security Architecture - DGX Cloud

NVIDIA•US, WA, Remote, WA

2d•$272,000 - $431,250

About The Position

NVIDIA DGX Cloud is an AI Factory designed to power the next generation of AI and industrial-scale breakthroughs. As a Principal Engineer for Security Architecture, within our Security Engineering organization, you will own a core security domain of the AI factory: the architecture, the paved road that delivers it, and much of the code underneath. You will hold the security design bar across DGX Cloud from inside the teams doing the building, and this is a founding seat on a new team. Security Engineering is a new organization at DGX Cloud, accountable for the security outcome of the platform, and Security Architecture is the function inside it that holds the design bar. Security here is fleet horizontal and stack vertical, so your work will cross every DGX Cloud engineering organization: you will embed with the teams building GPU clusters, control planes, and services, join their designs as a participant rather than an approver, and leave behind systems in which an entire class of risk is no longer possible. There is no architecture review board here and no approval queue. You are a senior IC with deep security domain knowledge, and the security bar holds because you helped set it and then helped ship it.

Requirements

Security and Infrastructure Engineering: Experience (typically 15+ years) across software engineering, SRE, infrastructure, and security engineering. You build systemic solutions rather than performing manual operations or "tool administration."
Production-Grade Coding: A strong software engineering background with the ability to write clean, maintainable, and well-tested code. You should be comfortable building and operating production services at scale.
Emerging Technology: You work with what is new rather than waiting for it to settle. Today that means writing and reviewing AI-generated code at the volume it now arrives, putting AI-assisted analysis to work in your own security engineering, and building for agents that act inside the systems you own. Tomorrow it will mean something else.
Security Architecture in Practice: Designs you own that actually got built and run, in areas like multi-tenant isolation, identity and access, policy enforcement, vulnerability management, or detection engineering. You stayed on to operate them.
Threat Modeling and System Design: Proven ability to build threat models for complex distributed systems, identify the architectural gaps rather than only the bugs, and engineer the solutions that close them.
Distributed Systems and Linux Depth: Cloud-native architecture, container orchestration (Kubernetes), and hands-on Linux systems security including kernel-level primitives (eBPF, AppArmor, or SELinux).
Influence Without Authority: Experience landing designs through teams you do not own, in environments where credibility and relationships, not org charts, determine whether the work ships.
Foundation: Bachelor's degree in Computer Science, Engineering, or a related technical field (or equivalent experience) with 15+ yrs of relevant experience.

Nice To Haves

HPC/AI Security: Experience securing high-performance computing environments, RDMA-based networks, large GPU fleets, or GPU-specific security challenges.
Cloud-Native Identity and Attestation: Expertise in workload identity frameworks (e.g., SPIFFE/SPIRE), hardware root of trust (TPM/HSM) integration, or confidential computing.
Offensive Depth Turned Defensive: Real exploitation, red team, or security research experience that you have converted into engineering: the controls, guardrails, and detections that closed what you found for good.
Open Source Impact: Notable contributions to security-focused open-source projects or a track record of engineering-focused security research. How have you represented and helped advance the industry?

Responsibilities

Own a Security Domain End to End: Take architectural ownership of a core domain of DGX Cloud security, from the design through the system running in production. That could be tenant and GPU workload isolation, workload identity, infrastructure and network, supply-chain provenance, hardened baselines and patching, or deploy-time policy and admission control.
Embed with the Teams Building It: Join the design early, write the code, and help land it. The posture is not "you did this wrong." It is "here are the considerations we need to meet, I will help, let's go to work."
Build Paved Roads, Not Gates: Engineer the secure path into the platform so that it is also the easy path. You are measured by whether teams take that path by default, not by the number of requirements you have written down.
Engineer Classes of Risk Out of Existence: Finding a vulnerability is 4% of the work; building the system where it cannot happen again is the other 96%. When teams keep missing the same requirement, the paved road is wrong, and fixing the road is our job rather than theirs.
Threat Model and Attack the Design: Run deep-dive threat models across the substrate, the orchestration layer, and the tenancy boundary, then go after your own designs offensively and feed what you find back into the baselines, the guardrails, and the detections.
Carry the Bar into Execution: Turn the DGX Cloud security bar into reference architectures, requirements, and golden paths teams can build against. Raise gaps early, in the design, with the work to close them attached.
Multi-Functional Collaboration: Partner with DGX Cloud platform, production engineering, and network security teams, and with NVIDIA's central security organization, to make the secure path real in CI/CD and in the hardware lifecycle. We operate horizontally across vertically organized teams, with influence rather than authority.