Staff Security Engineer

🔥 14 hours ago

🇺🇸 United States – Remote

💵 $136k - $231k / year

⏰ Full Time

🔴 Lead

👮‍♂️ Cybersecurity / Security Engineer

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 0%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Calix

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

Founded 2000

📡 Telecommunications

☁️ SaaS

🏢 Enterprise

💰 $50M Venture Round on 2009-08

Telecommunications • SaaS • Enterprise

Calix is a comprehensive solutions provider that focuses on enabling broadband service providers (BSPs) to simplify, innovate, and grow their businesses. Through its advanced broadband platform, Calix offers technologies like 10G-PON, 5G, Wi-Fi 7, and more to improve network operations, reduce downtime, and enhance the subscriber experience. The company provides managed services such as SmartLife and SmartHome, which help subscribers operate, secure, and enhance their connected lifestyles. Calix serves diverse provider types including telcos, cable operators, and municipal utilities, helping them deliver critical broadband connectivity and transform community access to digital services. With a focus on cloud technology, analytics, and transformation guidance, Calix empowers service providers to thrive in the digital age.

📋 Description

• Define and strengthen trust architecture connecting devices, customers and the cloud platform • Design and run PKI on GCP, including offline root, HSM-backed issuing CAs, certificate profiles and key ceremonies • Define device identity, factory provisioning, field enrollment, rotation, revocation and CA key-compromise response • Architect workforce, workload and customer identity using SSO, Workforce Identity Federation, OAuth 2.0 and OIDC • Secure device-to-cloud communications with mutual TLS, per-device authorization and protections against replay, cloned devices and fleet-wide denial of service • Own security of the GCP ingestion layer using MQTT brokers and gateways on GKE feeding Pub/Sub, Dataflow and BigQuery • Secure remote commands and over-the-air updates • Set on-device security requirements including secure boot, signed and rollback-protected firmware, encrypted storage, locked debug ports and hardened OS images • Perform hands-on firmware analysis, hardware and local-interface attacks, protocol fuzzing and companion mobile-app security • Govern the firmware supply chain, including SBOMs, vulnerability management, signing-key custody and vendor assessments • Build threat models and conduct penetration tests, red-team and purple-team exercises • Set GCP guardrails across organization policy, VPC Service Controls, IAM, Cloud KMS, GKE, Binary Authorization, CI/CD and data pipelines • Map controls to ISO 27001, SOC 2, NIST CSF, CIS Controls, ETSI EN 303 645, NIST IR 8259, GSMA baseline controls and FCC CPNI rules • Serve as escalation point for security decisions and incidents, mentor senior engineers and brief executives

🎯 Requirements

• BS or MS in computer science, information security or cryptography, or equivalent experience • 10+ years in security engineering • Deep ownership of at least two of: PKI, identity and access, device security, or cloud security architecture • PKI expertise including X.509 profiles, CA hierarchy design, HSM and key management, certificate lifecycle automation, revocation at scale, and EST, SCEP and ACME • Experience with GCP Certificate Authority Service or a comparable managed CA • Identity expertise including OAuth 2.0, OIDC, SAML, SSO and federation • Experience running or integrating an enterprise IdP • Experience designing token and session security for apps and devices • Strong GCP security experience with IAM, Workload Identity Federation, Cloud KMS, VPC Service Controls, GKE and container security, Security Command Center, BigQuery, Dataflow, Datastream and Kafka • Knowledge of mutual TLS, MQTT and gRPC security, broker and gateway hardening, and OTA update integrity • Hands-on device and embedded security skills, including secure boot, TPM or secure element use, firmware analysis, hardware debug interfaces, and Android and iOS mobile app security • Hands-on offensive security skills and ability to threat-model a full device-to-cloud system • Ability to write tooling in Python, Go or similar • Experience with CI/CD and DevSecOps security • Experience with ISO 27001, SOC 2, NIST CSF and CIS Controls • Record of influencing architecture across multiple teams • Clear writing and briefing skills

🏖️ Benefits

• Competitive Benefits and Vacation package • Opportunity to work on cutting-edge projects impacting millions of users • Collaborative culture with continuous learning and growth • Potential eligibility for a bonus

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume