Lead Security Architect – Cloud Platform & Network Security

Key Responsibilities

• Zero-Trust Workload Identity: Architect and implement identity frameworks (e.g., SPIFFE/SPIRE, mTLS, Service Mesh) to establish cryptographically verified identity for microservices operating across cloud, ground segment nodes, and hybrid edge hardware.
• SDN & Control Plane Hardening: Conduct threat modeling and design runtime security controls for our Software-Defined Networking (SDN) stack, protecting routing protocols, control messages, and telemetry streams from spoofing, tampering, and denial-of-service (DoS) attacks.
• Runtime Defense & Policy Enforcement: Deploy eBPF-based runtime monitoring (e.g., Tetragon, Falco, Cilium) and policy-as-code admission controllers (OPA/Gatekeeper) to detect and neutralize zero-day exploits, container breakouts, and unauthorized process executions in real time.
• Key Ceremonies & PKI Governance: Design, orchestrate, and execute formal cryptographic key ceremonies (multi-party key generation, root CA creation, and secret splitting) to establish trust anchors for root certificate authorities, satellite communication keys, and cloud/ground HSM clusters.
• Hardware-Backed Key & Cryptographic Management: Oversee the architecture for root-of-trust, Hardware Security Modules (HSMs), TPMs, and Vault clusters managing satellite communications keys, TLS certificates, and secrets lifecycle.
• Security Telemetry & Anomaly Detection: Collaborate with the Platform team to embed security observability into high-throughput logging and telemetry pipelines (Kafka, Prometheus, SIEM/SOAR) for automated threat detection and incident response.
• Defense & Federal Compliance: Translate rigorous federal and defense cybersecurity mandates (e.g., NIST SP 800-53, CMMC Level 3+, FedRAMP High, DoD IL5/IL6) into technical security designs without compromising platform agility or speed.

Basic Qualifications

• Education: Bachelor’s degree in Computer Science, Cybersecurity, Computer Engineering, or equivalent practical experience.
• Experience: 10+ years in cybersecurity, software engineering, or infrastructure security, with 5+ years architecting security for distributed cloud platform software.
• Technical Expertise: Deep understanding of Kubernetes architecture, container isolation, Linux kernel security, and eBPF technology. Hands-on experience with modern networking protocols, zero-trust architectures, service meshes (Istio/Cilium), and mTLS.
• Hands-on architectural experience with HSMs, TPMs, and enterprise secrets management (e.g., HashiCorp Vault).

Preferred Qualifications

• Experience securing carrier-grade telecom, aerospace, satellite ground stations, or critical defense network infrastructure.
• Demonstrated experience handling threat modeling (STRIDE/ATT&CK) for real-time distributed routing or control plane systems.
• Deep knowledge of public cloud security guardrails across AWS, GCP, or Azure alongside hybrid/on-prem deployments.