Staff Security Engineer

Key Responsibilities

• Define the architecture for Catalyst's authentication and authorization layer (e.g., OIDC, OAuth2, and SAML, RBAC, ABAC models) and help set the patterns other engineers build against
• Drive reliability and security strategy for the trust layer: define SLOs and SLAs for authn/authz latency and availability, lead incident response for credential and access-control incidents, and design for safe revocation under partial failure
• Participate in on-call and incident response for our data platform including leading post-incident reviews, triage, prevention, and mitigation
• Define and implement secure-by-default developer patterns and infrastructure primitives to reduce security friction and eliminate common vulnerability classes (e.g., standardized authentication middleware, automated credential lifecycle management, and hardened service-to-service communication patterns using mTLS and SPIFFE/SPIRE)
• Define the QA philosophy and test strategy for the security layer, including threat modeling, adversarial test coverage, and session and revocation edge cases, and own the security quality gates in the deployment pipeline (e.g., integrating SCA, SAST, and container image scanning)
• Implement and review pull requests across session, token, and authentication systems ensuring that security, testing, and operational readiness
• Architect and implement encryptions at rest and in transit, key hierarchies, and HSM/KMS integration (e.g., using HashiCorp Vault or cloud-native KMS providers)
• Lead team rituals such as design discussions to improve culture, surface new ideas, risks, and strategies across the team
• Partner with security and IT teams to align on networking, observability, and identity patterns (e.g., including VPCs, network policies, IAM, and service mesh configurations) and ensure compliance with relevant industry standards (e.g., OWASP, ISO 27001, NIST, SOC 2)
• Lead offensive security and vulnerability discovery efforts (e.g., directing third-party penetration tests, conducting internal red-team exercises, regular security assessments and penetration testing) against core platform components to identify and remediate vulnerabilities
• Being a force multiplier by championing security programs, patterns, standards, and documentation
• Grow team capability through deliberate coaching; mentor senior engineers on secure API and protocol design
• Travel up to 25% for customer engagement, architecture reviews, or team collaboration (Middle East)

Required Qualifications

• 7+ years of experience, with a track record of shaping whole platform or infrastructure security areas rather than individual features
• Deep hands-on experience designing and operating mTLS and TLS-based trust in distributed, multi-service systems, including certificate issuance, x509 validation, CA bundle management, and key rotation
• Proven experience building authorization engines and policy models from scratch, including designing the interfaces that other engineers implement against
• Strong background in identity and credential lifecycle: JWT and token issuance and verification, credential grants, session semantics, and revocation across federated or multi-tenant environments
• Fluency in Go and protobuf/gRPC service design, with experience securing gRPC contracts and service-to-service communication in a service mesh or comparable architecture
• A working threat modeling practice: you can reason about attacker paths across host and plugin boundaries, enrollment flows, and tenant isolation gaps, and translate that into concrete architecture
• Exceptional communication skills across technical and non-technical audiences; you routinely interface with customers, product leaders, and engineering teams to gather requirements, articulate security trade-offs, and drive alignment from initial design to delivery
• Has set technical direction others followed, and can point to a subsystem and explain what they built and what they'd do differently
• Travel up to 25% for customer engagement, architecture reviews, or team collaboration (Middle East)

Desired Qualifications

• Experience designing secure APIs for multi-tenant platforms, including tenant isolation guarantees and secure-by-default plugin or extension boundaries
• Familiarity with policy engines such as Cedar or OPA, with experience deciding when to build a custom authorization model versus adopt one
• Experience securing enrollment or bootstrap flows for fleets of untrusted or semi-trusted nodes joining a distributed system
• Background in national security, intelligence, or defense environments with direct understanding of mission-critical operational requirements
• Active security clearance (Secret or above); Top Secret preferred

Physical Requirements

• Prolonged periods of sitting at a desk and working on a computer
• Participation in virtual and in-person meetings
• Ability to attend planned meetings and/or work in classified spaces for extended periods within the specified work regions
• TRAVEL: International travel to Middle East and geopolitical hot zones, up to 25% per calendar year is required . Please apply only if you can meet this requirement

Orbis Benefits

• Beyond the opportunity to work alongside practitioners who have operated at the mission edge, joining Orbis means real ownership over outcomes that matter — the chance to build technology that gives the United States Government and its allies a genuine decision advantage, not just another dashboard. From competitive retirement matching to a PTO policy that encourages real time off, we're committed to creating an environment where our team can do their best work and still have a life outside of it.
• Our comprehensive benefits package is designed to meet the diverse needs of our employees and their families. A full list of benefits is shared with candidates following an initial conversation with our HR team, so you'll have a clear picture of the support and resources available to you as part of the Orbis team.

Orbis Locations

• Orbis works in whatever arrangement the mission requires. Depending on the role, that might mean five days a week on a customer site, full-time in one of our offices, a hybrid schedule, or fully remote work — our team is spread across 25 states and four countries to match. We make sure every team member has the tools and access needed to do the work, wherever that work happens.
• Travel is common across many Orbis roles, particularly those supporting customer missions in the field.
• Orbis is headquartered in McLean, VA, with additional office locations in Taipei, Taiwan, and Canberra, Australia.

EEO Statement