[Hiring] Staff Security Engineer @Calix

Role Description

We’re looking for a Staff Security Engineer to define and strengthen the trust architecture connecting our devices, customers, and cloud platform. In this highly influential, hands-on role, you’ll serve as a senior technical authority across:

• Device identity
• PKI
• Cloud and workload identity
• Secure device-to-cloud communications
• Embedded security

You’ll partner across device, network, mobile, and cloud engineering teams to:

• Design resilient security architecture
• Pressure-test it through threat modeling and offensive testing
• Drive solutions from design through production

Qualifications

• BS or MS in computer science, information security or cryptography, or equivalent experience
• 10+ years in security engineering, with deep ownership of at least two of: PKI, identity and access, device security, or cloud security architecture
• PKI depth: X.509 profiles, CA hierarchy design, HSM and key management, certificate lifecycle automation, revocation at scale, and protocols such as EST, SCEP and ACME
• Identity depth: OAuth 2.0, OIDC, SAML, SSO and federation; running or integrating an enterprise IdP; designing token and session security for apps and devices
• Strong GCP security experience: IAM, Workload Identity Federation, Cloud KMS, VPC Service Controls, GKE and container security, Security Command Center, and securing data pipelines (BigQuery, Dataflow, Datastream, Kafka)
• Applied knowledge of secure device-to-cloud communication: mutual TLS, MQTT and gRPC security, broker and gateway hardening, and OTA update integrity
• Hands-on device and embedded security skills: secure boot, TPM or secure element use, firmware analysis, hardware debug interfaces, and mobile app security on Android and iOS
• Hands-on offensive skills and the ability to threat-model a full device-to-cloud system; you write tooling in Python, Go or similar
• Experience with CI/CD and DevSecOps security, and with ISO 27001, SOC 2, NIST CSF and CIS Controls
• A record of influencing architecture across multiple teams, with clear writing and briefing skills

Requirements

• Design and run our PKI on GCP: offline root, HSM-backed issuing CAs in Certificate Authority Service, certificate profiles, and key ceremonies
• Define device identity: unique keys in a secure element or TPM, factory provisioning, field enrollment (for example EST), rotation, revocation, and a tested plan for CA key compromise
• Architect workforce, workload and customer identity: SSO and Workforce Identity Federation, Workload Identity Federation instead of service account keys, and OAuth 2.0 and OIDC flows for apps and devices
• Secure the path from device to cloud: mutual TLS, per-device authorization, and protection against replay, cloned devices and fleet-wide denial of service
• Own security of the ingestion layer on GCP (self-operated MQTT brokers and gateways on GKE feeding Pub/Sub, Dataflow and BigQuery), since Cloud IoT Core was retired in 2023
• Secure remote commands and over-the-air updates so a compromised cloud account cannot push malicious firmware to the fleet
• Set on-device requirements: secure boot, signed and rollback-protected firmware, encrypted storage, locked debug ports, and a hardened OS image
• Test devices hands-on: firmware analysis, hardware and local-interface attacks (Bluetooth, Wi-Fi, USB, serial), and protocol fuzzing; secure the companion mobile apps
• Govern the firmware supply chain: SBOMs, vulnerability management, signing-key custody, and manufacturer and silicon-vendor assessments
• Build threat models for the full device, app, gateway and cloud system (STRIDE, attack trees, MITRE ATT&CK), and run pentests, red-team and purple-team exercises
• Set GCP guardrails: organization policy, VPC Service Controls, IAM, Cloud KMS, GKE hardening, Binary Authorization, and secure CI/CD and data pipelines (BigQuery, Dataflow, Datastream, Kafka)
• Map controls to ISO 27001, SOC 2, NIST CSF, CIS Controls, ETSI EN 303 645, NIST IR 8259, GSMA baseline controls and FCC CPNI rules
• Be the escalation point for hard security decisions and incidents, mentor senior engineers, and brief executives

Benefits

• Be part of a team driving AI innovation in telecom and cloud solutions
• Opportunity to work on cutting-edge projects impacting millions of users
• Collaborative culture with continuous learning and growth
• Competitive Benefits and Vacation package