Staff Security Engineer (Top Secret Clearance Required)

Orbis

2d

About The Position

Orbis is seeking a Staff Security Engineer to drive the security and trust architecture across Catalyst, its secure multi-cluster service mesh platform. The engineer will establish patterns for authentication, authorization, and tenant isolation, and set technical direction for infrastructure security. The role involves designing and operating platform-wide security capabilities, improving reliability and security, guiding engineering practices, and partnering with security, IT, product, customer, and engineering teams. It requires international travel to the Middle East and geopolitical hot zones of up to 25% per calendar year.

Requirements

• Active Top Secret security clearance.
• At least 7 years of experience, with a track record of shaping platform-wide or infrastructure security areas rather than individual features.
• Deep hands-on experience designing and operating mTLS and TLS-based trust in distributed, multi-service systems, including certificate issuance, X.509 validation, CA bundle management, and key rotation.
• Experience building authorization engines and policy models from scratch, including designing interfaces for other engineers to implement against.
• Strong identity and credential lifecycle background, including JWT and token issuance and verification, credential grants, session semantics, and revocation across federated or multi-tenant environments.
• Fluency in Go and protobuf/gRPC service design, including securing gRPC contracts and service-to-service communication in a service mesh or comparable architecture.
• Practical threat-modeling ability, including analyzing attacker paths across host and plugin boundaries, enrollment flows, and tenant-isolation gaps and translating findings into architecture.
• Exceptional communication skills with technical and non-technical audiences; ability to work with customers, product leaders, and engineering teams to gather requirements, explain security trade-offs, and drive alignment from design through delivery.
• Experience setting technical direction that others followed, with the ability to explain what was built and what could be done differently.
• Ability to travel up to 25% for customer engagement, architecture reviews, or team collaboration, including travel to the Middle East.
• Ability to attend planned meetings and/or work in classified spaces for extended periods within the specified work regions.

Nice To Haves

• Experience designing secure APIs for multi-tenant platforms, including tenant-isolation guarantees and secure-by-default plugin or extension boundaries.
• Familiarity with policy engines such as Cedar or OPA, including deciding when to build a custom authorization model versus adopt an existing one.
• Experience securing enrollment or bootstrap flows for fleets of untrusted or semi-trusted nodes joining a distributed system.
• Background in national security, intelligence, or defense environments and direct understanding of mission-critical operational requirements.

Responsibilities

• Define Catalyst's authentication and authorization architecture, including identity protocols and role- or attribute-based access-control models, and establish implementation patterns for other engineers.
• Set reliability and security strategy for the trust layer, define authentication and authorization service-level objectives and agreements, lead credential and access-control incident response, and design safe revocation under partial failure.
• Participate in data-platform on-call and incident response, including triage, mitigation, prevention, and post-incident reviews.
• Create secure-by-default developer patterns and infrastructure primitives, including standardized authentication middleware, automated credential lifecycle management, and hardened service-to-service communication using mTLS and SPIFFE/SPIRE.
• Define the security layer's QA philosophy and test strategy, including threat modeling, adversarial testing, session and revocation edge cases, and deployment-pipeline security quality gates such as SCA, SAST, and container image scanning.
• Implement and review pull requests for session, token, and authentication systems, ensuring security, testing, and operational readiness.
• Architect and implement encryption at rest and in transit, key hierarchies, and HSM/KMS integrations.
• Lead team rituals such as design discussions to surface ideas, risks, and strategies and improve team culture.
• Partner with security and IT teams on networking, observability, and identity patterns, including VPCs, network policies, IAM, and service mesh configurations, and support compliance with relevant standards.
• Lead offensive security and vulnerability-discovery efforts, including third-party penetration tests, internal red-team exercises, and regular platform security assessments.
• Champion security programs, patterns, standards, and documentation to multiply team effectiveness.
• Coach team members and mentor senior engineers on secure API and protocol design.
• Travel up to 25% for customer engagement, architecture reviews, or team collaboration, including travel to the Middle East.

Benefits

• Competitive retirement matching.
• PTO policy that encourages employees to take real time off.
• Comprehensive benefits package for employees and their families; the full list is shared with candidates following an initial HR conversation.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed