Senior Engineer, Platform Security and Reliability

Kairos Power•Alameda, CA

About The Position

Kairos Power is seeking a Senior Platform Security and Reliability Engineer to join a small software and infrastructure team supporting design, research, and development organizations. This is a hands-on individual-contributor role responsible for the security baseline and reliability of cloud and high-performance computing platforms, including building the controls, automation, and recovery mechanisms needed to keep them secure and dependable. The engineer will set technical direction for platform security across AWS and Google Cloud, identity and secrets management, machine image security, network security, and observability. The role also leads migration of legacy cloud workloads, retirement of duplicative services, and cost visibility and resource guardrails for cloud and high-performance computing environments. The engineer leads availability and security incident response and communicates with affected engineers and stakeholders. The team values simple, proportionate designs using standard, supported technologies, and expects systems to be maintainable by engineers beyond their original authors. The position may be remote or on-site in Alameda, California. Some travel may be required for workshops and project assistance. The work may involve a general office environment, remote work, and a high-concentration, demanding, fast-paced setting. The role occasionally requires weekend work, schedule flexibility, and extended hours to support launches and critical project timelines. The position is located at a facility handling information subject to Department of Energy export controls; authorization to access Part 810-controlled information is required to work in the facility.

Requirements

Bachelor’s degree in computer science, engineering, physics, mathematics, or a related technical field, or equivalent practical experience.
At least 5 years of relevant experience in platform, infrastructure, cloud, security, site reliability engineering, or a related field, including designing, securing, and operating production cloud infrastructure.
Demonstrated experience designing, securing, and operating production cloud infrastructure, with strong AWS experience.
Strong Linux systems experience, including administration, hardening, and troubleshooting.
Experience with infrastructure automation, including infrastructure as code, configuration management, and programming or scripting.
Experience implementing platform security controls in areas such as access management, network security, secrets management, vulnerability management, and security monitoring.
Experience designing and operating monitoring, recovery, and incident-response capabilities for production systems.
Demonstrated ability to design maintainable infrastructure and make sound technical tradeoffs involving security, reliability, performance, cost, and complexity.
Knowledge of networking fundamentals, including DNS, TLS, routing, firewalls, segmentation, and remote access.
Knowledge of platform security principles, including least-privilege access, identity and access management, secrets management, vulnerability management, and defense in depth.
Ability to translate security, reliability, and operational requirements into practical automated controls.
Ability to use monitoring, logging, metrics, and service health indicators to identify, diagnose, and improve security and reliability issues.
Ability to assess technical risk, prioritize remediation, and drive issues to sustainable resolution.
Ability to work collaboratively, solve problems efficiently, and prioritize the safety of oneself and others.
Ability to collect, manage, and transfer knowledge proactively.
Ability to create efficiencies tied to measurable engineering needs such as safety, reliability, performance, usability, or maintainability.
Ability to exercise architectural judgment, favor simple designs, weigh security risk against engineering cost, and explain tradeoffs.
Ability to give and receive direct technical feedback and adjust course when reviews identify a better approach.
Ability to communicate clearly during incidents and keep stakeholders informed of impact, status, and resolution.
Ability to own systems throughout their lifecycle, including testing, documentation, and retirement.
Excellent written and verbal communication with technical and non-technical audiences.

Nice To Haves

Experience with Google Cloud, particularly designing a new environment.
Experience with cloud cost management, including cost attribution, budgets, and resource guardrails.
Experience securing high-performance computing environments, including Slurm, Open OnDemand, MPI, or GPU-enabled workloads.
Experience with container security, including Docker and Apptainer.
Experience operating self-hosted engineering services such as GitHub Enterprise, Overleaf, application servers, or relational databases.
Experience with vulnerability management and fleet-wide patch automation.
Experience automating control evidence against an established security control framework.
Experience supporting scientific or engineering computing users.
Advanced degree in a related technical field.

Responsibilities

Define, implement, and maintain the security baseline for cloud and Linux platforms, including operating system hardening, benchmark configuration, and secure defaults.
Own security controls in AWS and Google Cloud, including account and project structure, guardrails, service configuration, logging, and preventative and detective controls.
Design and enforce least-privilege access across cloud accounts, Linux systems, and internally hosted engineering services.
Secure machine image pipelines through hardening, vulnerability scanning, patching, automated testing, versioned releases, and rollback.
Assess new platform technologies for security impact and document decisions.
Own identity and access management across cloud and self-hosted services, including authentication, authorization, federation, and periodic access reviews.
Manage the full lifecycle of secrets and eliminate credentials embedded in code or configuration.
Own certificate issuance, automated renewal, expiry monitoring, and trust chain management.
Automate access provisioning and deprovisioning so entitlements reflect current need.
Translate internal security requirements into continuously running automated checks.
Build and maintain resource inventory and configuration data across cloud and self-hosted systems.
Automate control evidence collection and exception reporting, reducing manual compliance effort.
Track findings to closure and address recurring findings through systemic fixes.
Define service health indicators and service-level objectives for platform services.
Engineer automated recovery and self-healing for routine failure modes.
Own backup, restoration, and disaster recovery for critical services, with documented, rehearsed, and verified procedures.
Lead availability and security incident response, including diagnosis, containment, stakeholder communications, and follow-up.
Conduct blameless post-incident reviews and convert findings into concrete engineering work.
Own observability architecture, including metrics, logs, retention, and access.
Build and maintain dashboards in AWS Managed Grafana and actionable alerting routed to engineers’ work channels.
Ensure security-relevant events are collected, retained, searchable, and distinguished from routine activity through alerting.
Design and operate secure networking for self-hosted and cloud services, including segmentation, DNS, TLS, routing, firewalls, VPN, and zero-trust connectivity.
Own ingress and egress control for engineering and scientific computing environments and remove overly permissive access paths.
Document and standardize how engineers connect to internal services.
Lead migration of legacy cloud workloads into supported, standardized environments, including data movement, cutover planning, and verification.
Retire and consolidate unsupported or duplicative services, including decommissioning, archival, and removal of associated infrastructure.
Own cloud and high-performance computing cost visibility, including attribution, budgets, spend alerts, and resource guardrails.
Evaluate cost and reliability tradeoffs of platform changes using measured data.
Write, test, and maintain platform and security automation in Python or another general-purpose language using application-code engineering standards.
Lead infrastructure design and code reviews and provide feedback that improves team work.
Mentor engineers, transfer knowledge, and reduce single-person dependencies through documentation and shared ownership.
Evaluate build-versus-buy decisions and favor standard, well-supported technologies unless requirements demand otherwise.
Choose the simplest design that meets requirements and identify and retire technical debt, premature abstraction, and unnecessary complexity.
Collaborate with nuclear and other non-software engineers and explain security requirements in terms of their work.