Staff Software Engineer, Security Platform

Quick Facts

• Role: Staff Software Engineer, Security Platform
• Focus: Identity, authorization, PKI/credentials, and auditable security evidence for disconnected and regulated environments
• Deployment contexts: commercial cloud, government cloud, and classified/disconnected sites

Description

You will set the technical direction for the Security Platform team and define how Spacetime is secured across every environment it ships into. The work emphasizes verifiable offline trust decisions, identity-centered authorization, and building capabilities once so they behave consistently everywhere. You will collaborate with product, infrastructure, and developer platform teams to turn requirements into reusable security capabilities and standards.

Responsibilities

• Build authentication and authorization, including token validation, trust anchors, principal namespace, and a permission model
• Design authorization for delegation, multi-tenancy, and machine-to-machine access
• Define infrastructure access control including a break-glass path
• Own auth SDKs used by engineering teams and customers to access Spacetime APIs
• Own end-to-end PKI: certificate authorities, issuance policy, rotation, and revocation
• Issue workload identity and provide libraries/services to present it for mesh and infrastructure
• Own secrets and keys access model and client libraries
• Design audit and structured logging schemas so every authorization decision is reconstructable as evidence
• Ensure evidence supports regulated/classified environments, including sites without upstream connectivity
• Operate and maintain what you build: availability, upgrades, security maintenance, and incident response
• Threat-model across the platform and build mitigations that eliminate classes of vulnerabilities
• Set security standards for hardened images, mesh policy, supply chain, and CI/CD pipeline gates
• Run production security operations and help other teams adopt the same security standards
• Convert product requirements into security capabilities other teams can adopt

Requirements

• 10+ years of backend software engineering on production services with ownership of dependent systems
• Deep experience in Go (or comparable backend language) with readiness to work in Go daily
• Built or been a core contributor and design owner of an authentication/authorization system, identity provider integration, certificate authority, or secrets/key management service
• Firsthand knowledge of token-based authentication failure modes (audience confusion, unverified issuers, key confusion, redirect handling)
• Working knowledge of Kubernetes and cloud infrastructure
• Experience setting technical direction across teams and gaining adoption without direct authority
• Experience mentoring engineers and improving design and code review quality
• Bachelor’s degree in Computer Science or related field, or equivalent practical experience
• ITAR/EAR eligibility to access export-controlled information

Benefits

• Competitive salary (pay range: $230,000–$250,000 USD per year) and equity options
• Comprehensive benefits including 401(k), dental, vision, health, and life insurance
• Paid time off
• Innovative environment shaping the future of aerospace communications
• Direct contribution to critical national security programs
• Growth opportunities for professional development
• Inclusive, collaborative, supportive culture
• Flexible working arrangements with hybrid remote/in-office schedules