Staff Software Engineer, Security Platform

Aalyria

12h•$230,000 - $250,000•Hybrid

About The Position

Aalyria is hiring a Staff Software Engineer on its Security Platform team to set the direction for how the company secures Spacetime. The team builds security capabilities once so they work consistently across commercial cloud, government cloud, and classified or disconnected environments, and so systems can produce their own compliance evidence. The role partners with product engineers and infrastructure and developer platform teams to make these capabilities the default across engineering. The security platform is evolving from capabilities developed alongside Spacetime into a coherent layer centered on identity. The engineer will shape that evolution and establish patterns followed by the rest of engineering. The work includes building identity, authorization, PKI, workload identity, secrets and key access, and audit capabilities that function in disconnected environments where trust decisions must be verifiable offline. The role also owns the operation of what it builds, including availability, upgrades, security maintenance, and incident response. It sets security standards for systems operated by other teams and works with those teams and product engineers to turn requirements into capabilities they adopt. The position involves access to export-controlled information, subject to applicable U.S. government export requirements.

Requirements

At least 10 years of backend software engineering experience on production services, including ownership of systems other teams depend on.
Deep experience in Go, or deep backend experience in a comparable language and readiness to work in Go daily.
Built, or served as a core contributor and design owner of, at least one of: an authentication or authorization system inside a product, an identity provider integration, a certificate authority, or a secrets or key management service.
Firsthand knowledge, gained through shipping systems, of failure modes in token-based authentication, including audience confusion, unverified issuers, key confusion, and redirect handling at token endpoints.
Working knowledge of Kubernetes and cloud infrastructure.
Experience setting technical direction across teams, including writing design documents, driving decisions to closure, and earning adoption without direct authority.
Experience mentoring engineers and raising the quality of design and code review.

Nice To Haves

Experience building for regulated, disconnected, or high-assurance environments.
Experience integrating or operating an OIDC provider such as Zitadel, Keycloak, Okta, Auth0, or comparable.
Experience with authorization at scale, including policy engines, RBAC or ReBAC models, or fine-grained permission services.
Experience with SPIFFE/SPIRE, Vault, cloud KMS, or HSM-backed key management.
Experience with audit logging or evidence generation for FedRAMP, DoD Impact Levels, or a comparable regime.
Experience setting infrastructure security standards, such as hardened images, supply-chain security, or CI/CD pipeline gates.
Experience threat-modeling distributed systems.
Bachelor's degree in Computer Science or a related technical field, or equivalent practical experience.

Responsibilities

Build authentication and authorization for Spacetime, including token validation, trust anchors, the principal namespace, and the permission model operators configure.
Design authorization that supports delegation, multi-tenancy, and machine-to-machine access.
Define the access control model for Spacetime infrastructure, including the break-glass path.
Own the authentication SDKs used by engineering teams and customers to access Spacetime APIs.
Own PKI end to end, including certificate authorities, issuance policy, rotation, and revocation.
Issue workload identity and build libraries that services use to present it for consumption by service meshes and infrastructure.
Own the access model for secrets and keys, and the client libraries teams use to access them.
Design audit and structured logging schemas that make authorization decisions reconstructable after the fact and suitable as evidence in regulated and classified environments.
Operate built systems, including availability, upgrades, security maintenance, and incident response.
Threat-model across the platform and build mitigations that eliminate classes of vulnerabilities.
Set security standards for systems other teams operate, including hardened images, mesh policy, supply-chain security, and pipeline gates; work with infrastructure and developer platform teams that implement them.
Work with product engineers to translate requirements into capabilities they adopt.
Set technical direction across teams through design documents, decision-making, and adoption without direct authority.
Mentor engineers and improve the quality of design and code review.