Senior Engineer, Platform Security and Reliability

Description

The company is a new nuclear energy technology and engineering firm commercializing a fluoride-salt-cooled, high-temperature reactor (FHR), designed for robust safety, affordable cost and flexible operation alongside variable renewables.

You will join a small software and infrastructure team serving the design, research and development groups. This is a hands-on individual contributor role.

You will own the security baseline and reliability of the cloud and high-performance computing platforms engineering teams rely on. You will build the controls, automation and recovery mechanisms that keep those platforms defensible and dependable.

You will set technical direction across AWS and Google Cloud for platform security, identity and secrets, machine image security, network security and observability. You will also lead the move of legacy cloud workloads off unsupported services, and own cost visibility and guardrails for cloud and high-performance computing spend.

The team prefers simple, proportionate designs built from standard, well-supported tools, and you will be a leading advocate for that approach. Success means becoming the trusted owner of platform security and reliability, with systems others can run and maintain after you.

Responsibilities

• Define, implement and maintain the security baseline for cloud and Linux platforms, covering OS hardening, benchmark configuration and secure defaults for new environments.
• Own security controls in AWS and Google Cloud, including account and project structure, guardrails, service configuration, logging, and preventative and detective controls.
• Design and enforce least-privilege access across cloud accounts, Linux systems and internal engineering services.
• Own the security of machine image pipelines: hardening, vulnerability scanning, patch currency, automated testing, versioned releases and rollback.
• Assess the security impact of new platform technologies before adoption, and record the reasoning behind each decision.
• Own identity and access management across cloud and self-hosted services, including authentication, authorization, federation and periodic access reviews.
• Manage the full secrets lifecycle (storage, distribution, rotation and revocation), and remove credentials embedded in code or configuration.
• Own the certificate lifecycle: issuance, automated renewal, expiry monitoring and trust chain management.
• Automate provisioning and deprovisioning so access matches current need, not past history.
• Turn internal security requirements into automated checks that run continuously instead of periodic manual reviews.
• Maintain resource inventory and configuration data for cloud and self-hosted systems, so coverage gaps are visible.
• Automate control evidence collection and exception reporting, and reduce the manual work needed to prove controls function.
• Track findings to closure, and replace repeated manual fixes with systemic solutions.
• Define service health indicators and SLOs for platform services, and hold the platform to them.
• Build automated recovery and self-healing so routine failures resolve without human action.
• Own backup, restoration and disaster recovery for critical services, with documented, rehearsed and verified procedures.
• Lead response to availability and security incidents: coordinate diagnosis and containment, keep affected engineers informed, and drive follow-up work to closure.
• Run blameless post-incident reviews and turn findings into concrete engineering tasks, not advisory notes.
• Own observability architecture for platform services, including metrics, logs, retention and access.
• Build and maintain dashboards in AWS Managed Grafana and alerts that are actionable rather than noisy, routed to the channels engineers use.
• Make sure security-relevant events are collected, retained and searchable, and that alerts separate meaningful signal from routine activity.
• Design and operate secure networking for self-hosted and cloud services, including segmentation, DNS, TLS, routing, firewalls, VPN and zero-trust connectivity.
• Own ingress and egress control for engineering and scientific computing environments, and remove overly permissive paths.
• Document and standardize how engineers connect to internal services, so connectivity is consistent across services.
• Lead migration of legacy cloud workloads into supported, standard environments, including data movement, cutover planning and verification.
• Drive retirement and consolidation of unsupported or duplicate services, including decommissioning, archival and removing the infrastructure behind them.
• Own cloud and high-performance computing cost visibility: attribution, budgets, alerts on unexpected spend and resource guardrails.
• Assess cost and reliability tradeoffs of platform changes, backing recommendations with measured data.
• Write, test and maintain platform and security automation in Python or another general-purpose language, to the same standard as application code.
• Lead infrastructure design and code reviews, giving feedback that clearly raises the quality of the team's work.
• Mentor engineers, share knowledge deliberately, and remove single-person dependencies through documentation and shared ownership.
• Make build-versus-buy decisions, favoring standard, well-supported technologies over custom infrastructure unless a requirement clearly calls for it.
• Pick the smallest design that meets the real requirement, and retire technical debt, premature abstraction and needless complexity.
• Work with nuclear and other non-software engineers, explaining security requirements in terms of their goals.

Requirements

• Bachelor's degree in computer science, engineering, physics, mathematics or a related technical field, or equivalent practical experience.
• 5+ years of relevant experience in platform, infrastructure, cloud, security, site reliability engineering or a related field, including designing, securing and operating production cloud infrastructure.
• Proven experience designing, securing and running production cloud infrastructure, with strong AWS experience.
• Strong Linux systems skills, including administration, hardening and troubleshooting.
• Experience with infrastructure automation: infrastructure as code, configuration management, and programming or scripting.
• Experience implementing platform security controls for access management, network security, secrets management, vulnerability management and security monitoring.
• Experience designing and running monitoring, recovery and incident response for production systems.
• Ability to design maintainable infrastructure and make sound tradeoffs between security, reliability, performance, cost and complexity.
• Knowledge of networking fundamentals: DNS, TLS, routing, firewalls, segmentation and remote access.
• Knowledge of platform security principles, including least privilege, identity and access management, secrets management, vulnerability management and defense in depth.
• Ability to turn security, reliability and operational requirements into practical, automated controls.
• Ability to use monitoring, logs, metrics and service health indicators to find, diagnose and improve security and reliability problems.
• Ability to assess technical risk, set remediation priorities and drive issues to lasting resolution.
• Ability to work effectively in a highly collaborative team.
• Ability to solve problems quickly and efficiently.
• Puts safety of yourself and others first.
• Ability to gather, manage and pass on knowledge proactively.
• Ability to make work more efficient, with each improvement tied to a measurable need such as safety, reliability, performance, usability or maintainability.
• Ability to apply architectural judgment and favor the simplest design that meets the requirement.
• Ability to weigh security risk against engineering cost, and explain the tradeoff to those affected.
• Ability to give and receive direct technical feedback, and change course when review shows a better approach.
• Ability to communicate clearly during incidents, keeping stakeholders updated on impact, status and resolution.
• Ability to own systems across their full lifecycle, including testing, documentation and retirement.
• Excellent written and verbal communication with technical and non-technical audiences.
• Ability to choose simple, proportionate designs, reason about maintainability and performance, and explain build-versus-buy tradeoffs.
• Desirable: experience with Google Cloud, especially designing a new environment.
• Desirable: experience with cloud cost management, including attribution, budgets and resource guardrails.
• Desirable: experience securing high-performance computing environments, including Slurm, Open OnDemand, MPI or GPU-enabled workloads.
• Desirable: experience with container security, including Docker and Apptainer.
• Desirable: experience operating self-hosted engineering services such as GitHub Enterprise, Overleaf, application servers or relational databases.
• Desirable: experience with vulnerability management and patch automation across a fleet.
• Desirable: experience automating control evidence against an established security control framework.
• Desirable: experience supporting scientific or engineering computing users.
• Desirable: an advanced degree in a related technical field.

Conditions

Position is based at the Alameda, CA headquarters for onsite work, with a salary range of $140,611 to $165,425.

The range shown is the typical range or starting rate for hires in California. Actual pay may depend on education, experience, knowledge, skills, ability, local market data for the work location, and comparison with current employees in the role.

Remote work is listed as an environmental condition, alongside a general office setting.

The work is demanding, with a high-concentration pace.

Some travel may be required for workshops and project support, up to 5% of time.

Occasionally requires weekend work, schedule flexibility, and extended hours to support launch and critical project timelines.

Physical demands include prolonged standing or sitting, moving between work locations, and communicating with others.

Safety duties include reading and interpreting hazardous warning signs and handling, cleaning and disposing of hazardous materials.

Export control: the facility handles information restricted by the Department of Energy under 10 CFR Part 810. You must be authorized by the Department of Energy to access Part 810-controlled information. Foreign nationals who are citizens of countries not on the Department of Energy's general authorization list may not work in the facility unless the Department of Energy issues the company an export control license covering that individual's access.

Benefits

• Competitive compensation packages.
• Medical, dental and vision coverage for employees and their dependents.
• Paid vacation.
• 401(k) and pre-tax health insurance, dependent care and commuter benefits (FSA).
• Full-time employees (excluding interns) are eligible for these benefits.