Senior Engineer, Platform Security and Reliability

Kairos Power•Alameda, CA

About The Position

Kairos Power is a nuclear energy technology and engineering company working to commercialize fluoride-salt-cooled, high-temperature reactors to support the transition to clean energy. The Senior Platform Security and Reliability Engineer will join a small software and infrastructure team supporting design, research, and development organizations. This is a hands-on individual contributor role and the technical owner of security and reliability for cloud and high-performance computing platforms used by engineering teams. The role sets technical direction for platform security across AWS and Google Cloud, identity and secrets management, machine image security, network security, and observability. It leads migration of legacy cloud workloads and retirement of duplicative services, and owns cost visibility and resource guardrails for cloud and high-performance computing. The engineer leads availability and security incident response and communicates with affected engineers and stakeholders. The team favors simple, proportionate designs using standard, well-supported technologies, and systems should be maintainable by engineers beyond their original authors.

Requirements

Bachelor’s degree in computer science, engineering, physics, mathematics, or a related technical field, or equivalent practical experience.
At least 5 years of relevant experience in platform, infrastructure, cloud, security, site reliability engineering, or a related field, including designing, securing, and operating production cloud infrastructure.
Strong AWS experience and demonstrated experience designing, securing, and operating production cloud infrastructure.
Strong Linux systems experience, including administration, hardening, and troubleshooting.
Experience with infrastructure automation, including infrastructure as code, configuration management, and programming or scripting.
Experience implementing platform security controls in areas such as access management, network security, secrets management, vulnerability management, and security monitoring.
Experience designing and operating monitoring, recovery, and incident-response capabilities for production systems.
Ability to design maintainable infrastructure and make sound tradeoffs involving security, reliability, performance, cost, and complexity.
Knowledge of networking fundamentals, including DNS, TLS, routing, firewalls, segmentation, and remote access.
Knowledge of platform security principles, including least-privilege access, identity and access management, secrets management, vulnerability management, and defense-in-depth.
Ability to translate security, reliability, and operational requirements into practical, automated technical controls.
Ability to use monitoring, logging, metrics, and service health indicators to identify, diagnose, and improve security and reliability issues.
Ability to assess technical risk, prioritize remediation, and drive issues to sustainable resolution.
Ability to work collaboratively, solve problems efficiently, and prioritize personal and others’ safety.
Ability to collect, manage, and transfer knowledge proactively.
Ability to create efficiencies tied to measurable engineering needs such as safety, reliability, performance, usability, or maintainability.
Ability to exercise architectural judgment, favor simple designs, and explain security and engineering cost tradeoffs.
Ability to give and receive direct technical feedback and change course when review identifies a better approach.
Ability to communicate clearly during incidents and keep stakeholders informed of impact, status, and resolution.
Ability to own systems through their full lifecycle, including testing, documentation, and retirement.
Excellent written and verbal communication with technical and non-technical audiences.

Nice To Haves

Experience with Google Cloud, particularly designing a new environment.
Experience with cloud cost management, including cost attribution, budgets, and resource guardrails.
Experience securing high-performance computing environments, including Slurm, Open OnDemand, MPI, or GPU-enabled workloads.
Experience with container security, including Docker and Apptainer.
Experience operating self-hosted engineering services such as GitHub Enterprise, Overleaf, application servers, or relational databases.
Experience with vulnerability management and patch automation across a fleet.
Experience automating control evidence against an established security control framework.
Experience supporting scientific or engineering computing users.
Advanced degree in a related technical field.

Responsibilities

Define, implement, and maintain security baselines for cloud and Linux platforms, including operating-system hardening, benchmark configuration, and secure defaults.
Own AWS and Google Cloud platform controls, including account and project structure, guardrails, service configuration, logging, and preventative and detective controls.
Design and enforce least-privilege access across cloud accounts, Linux systems, and internally hosted engineering services.
Own secure machine-image pipelines, including hardening, vulnerability scanning, patch currency, automated testing, versioned releases, and rollback.
Assess and document the security impact of adopting new platform technologies.
Own identity and access management across cloud and self-hosted services, including authentication, authorization, federation, and periodic access reviews.
Manage the full lifecycle of secrets and certificates, and automate access provisioning and deprovisioning.
Translate security requirements into continuous automated checks; maintain resource inventory and configuration data; automate control evidence and exception reporting; and drive findings to closure and systemic remediation.
Define service health indicators and service-level objectives, and engineer automated recovery and self-healing for platform services.
Own backup, restoration, and disaster recovery for critical services, including documented, rehearsed, and verified restoration procedures.
Lead availability and security incident response, coordinate diagnosis and containment, communicate impact and status, and drive follow-up actions to closure.
Conduct blameless post-incident reviews and turn findings into concrete engineering work.
Own platform observability architecture, including metrics, logs, retention, access, dashboards in AWS Managed Grafana, and actionable alerting.
Ensure security-relevant events are collected, retained, searchable, and distinguished from routine activity.
Design and operate secure networking for self-hosted and cloud services, including segmentation, DNS, TLS, routing, firewalls, VPN, and zero-trust connectivity.
Own ingress and egress controls for engineering and scientific computing environments, remove overly permissive access paths, and standardize internal connectivity.
Lead migration of legacy cloud workloads into supported, standardized environments, including data movement, cutover planning, and verification.
Retire and consolidate unsupported or duplicative services, including decommissioning, archival, and infrastructure removal.
Own cloud and high-performance computing cost visibility, including cost attribution, budgets, unexpected-spend alerts, and resource guardrails.
Evaluate cost and reliability tradeoffs using measured data.
Write, test, and maintain platform and security automation in Python or another general-purpose language using application-code engineering standards.
Lead infrastructure design and code reviews, mentor engineers, transfer knowledge, and reduce single-person dependencies through documentation and shared ownership.
Evaluate build-versus-buy decisions and favor standard, well-supported technologies and the simplest design that meets requirements.
Identify and retire technical debt, premature abstraction, and unnecessary complexity.
Collaborate with nuclear and other non-software engineers and explain security requirements in terms of their work.