Staff Security Engineer (Top Secret Clearance Required) at Orbisoperations · LumiJobs

Responsibilities

Define the architecture for Catalyst's authentication and authorization layer (e.g., OIDC, OAuth2, and SAML, RBAC, ABAC models) and help set the patterns other engineers build against
Drive reliability and security strategy for the trust layer: define SLOs and SLAs for authn/authz latency and availability, lead incident response for credential and access-control incidents, and design for safe revocation under partial failure
Participate in on-call and incident response for our data platform including leading post-incident reviews, triage, prevention, and mitigation
Define and implement secure-by-default developer patterns and infrastructure primitives to reduce security friction and eliminate common vulnerability classes (e.g., standardized authentication middleware, automated credential lifecycle management, and hardened service-to-service communication patterns using mTLS and SPIFFE/SPIRE)
Define the QA philosophy and test strategy for the security layer, including threat modeling, adversarial test coverage, and session and revocation edge cases, and own the security quality gates in the deployment pipeline (e.g., integrating SCA, SAST, and container image scanning)
Implement and review pull requests across session, token, and authentication systems ensuring that security, testing, and operational readiness
Architect and implement encryptions at rest and in transit, key hierarchies, and HSM/KMS integration (e.g., using HashiCorp Vault or cloud-native KMS providers)
Lead team rituals such as design discussions to improve culture, surface new ideas, risks, and strategies across the team
Partner with security and IT teams to align on networking, observability, and identity patterns (e.g., including VPCs, network policies, IAM, and service mesh configurations) and ensure compliance with relevant industry standards (e.g., OWASP, ISO 27001, NIST, SOC 2)
Lead offensive security and vulnerability discovery efforts (e.g., directing third-party penetration tests, conducting internal red-team exercises, regular security assessments and penetration testing) against core platform components to identify and remediate vulnerabilities
Being a force multiplier by championing security programs, patterns, standards, and documentation
Grow team capability through deliberate coaching; mentor senior engineers on secure API and protocol design

Qualification

7+ years of experienceA working threat modeling practiceBackground in national securityPhysical Requirements

Required

Active security clearance Top Secret Clearance required.
7+ years of experience, with a track record of shaping whole platform or infrastructure security areas rather than individual features
Deep hands-on experience designing and operating mTLS and TLS-based trust in distributed, multi-service systems, including certificate issuance, x509 validation, CA bundle management, and key rotation
Proven experience building authorization engines and policy models from scratch, including designing the interfaces that other engineers implement against
Strong background in identity and credential lifecycle: JWT and token issuance and verification, credential grants, session semantics, and revocation across federated or multi-tenant environments
Fluency in Go and protobuf/gRPC service design, with experience securing gRPC contracts and service-to-service communication in a service mesh or comparable architecture
A working threat modeling practice: you can reason about attacker paths across host and plugin boundaries, enrollment flows, and tenant isolation gaps, and translate that into concrete architecture
Exceptional communication skills across technical and non-technical audiences; you routinely interface with customers, product leaders, and engineering teams to gather requirements, articulate security trade-offs, and drive alignment from initial design to delivery
Has set technical direction others followed, and can point to a subsystem and explain what they built and what they'd do differently
Travel up to 25% for customer engagement, architecture reviews, or team collaboration (Middle East)
Orbis complies with all applicable equal opportunity and non-discrimination laws in every jurisdiction in which we operate. Reasonable accommodation is available to applicants and employees with disabilities upon request.

Preferred

Experience designing secure APIs for multi-tenant platforms, including tenant isolation guarantees and secure-by-default plugin or extension boundaries
Familiarity with policy engines such as Cedar or OPA, with experience deciding when to build a custom authorization model versus adopt one
Experience securing enrollment or bootstrap flows for fleets of untrusted or semi-trusted nodes joining a distributed system
Background in national security, intelligence, or defense environments with direct understanding of mission-critical operational requirements.
Physical Requirements
Prolonged periods of sitting at a desk and working on a computer
Participation in virtual and in-person meetings
Ability to attend planned meetings and/or work in classified spaces for extended periods within the specified work regions

Staff Security Engineer (Top Secret Clearance Required)

Responsibilities

Qualification

Required

Preferred

Benefits

Company

Orbisoperations

More roles at Orbisoperations