Senior Security Engineer

Role Overview

We seek a seasoned Security Engineer to architect, deploy, and maintain security measures spanning infrastructure, applications, networks, and isolated computing environments. This technical role demands hands-on expertise in identity and access management, cryptography, secrets management, endpoint security, secure software delivery, and on-premises setups across connected sites, client data centers, and air-gapped systems. Security, operational discipline, and reliability are paramount.

Key Responsibilities

• Develop and administer identity and access control systems including Single Sign-On (SSO), Multi-Factor Authentication (MFA), federation protocols, privileged access, and machine identity management.
• Set up and manage Keycloak or a comparable self-hosted identity provider platform.
• Oversee secrets management, certificate lifecycle, public key infrastructure (PKI), certificate authority operations, cryptographic keys, and conduct secure key ceremonies.
• Apply security best practices to Linux environments, network infrastructure, endpoints, and on-premises facilities.
• Implement controls tailored for air-gapped environments such as regulated data transfers, offline patching, and network segmentation.
• Ensure secure operation of self-hosted source control and CI/CD pipelines, with preference for GitLab Self-Managed, including processes like secrets scanning, dependency analysis, and artifact signing.
• Support and maintain network security across multiple locations, including firewall configuration, IPsec tunnels, VPNs, reverse proxies, and access control policies.
• Conduct vulnerability assessments, facilitate security monitoring, coordinate incident responses, and execute infrastructure hardening protocols.
• Document all technical configurations, security settings, operational procedures, and maintain thorough audit trails.

Professional Requirements

• Minimum of five years in security engineering or related technical security roles specializing in infrastructure protection.
• Demonstrated capabilities with identity and access management technologies, particularly Keycloak and associated protocols including OIDC, SAML, SSO, federation, and MFA.
• Knowledge of PKI systems, certificate lifecycle control, cryptographic key management, and use of secrets management tools such as HashiCorp Vault or OpenBao.
• Proficient in Linux system security, networking fundamentals, and infrastructure defense strategies.
• Experience securing on-premises infrastructures, data centers, and isolated or air-gapped network environments.
• Understanding of advanced network segmentation techniques, firewalls, VPNs (IPsec), and secure remote connectivity solutions.
• Hands-on experience securing source code management and CI/CD infrastructures, preferably GitLab Self-Managed.
• Automation skills for security processes using Bash scripting, Python programming, Ansible, Terraform, or similar automation platforms.
• Experience in vulnerability identification, remediation techniques, security monitoring systems, and incident handling.
• Strong analytical skills with meticulous attention to detail and excellent documentation abilities explaining technical decisions.

Desirable Skills

• Experience managing an offline root Certificate Authority (CA) and executing or leading formal cryptographic key ceremonies.
• Practical exposure to Hardware Security Modules (HSMs).
• Familiarity with Mobile Device Management (MDM), Endpoint Detection and Response (EDR), and implementation of zero-trust security models.
• Sector experience in defense, government agencies, financial services, or critical infrastructure protection.
• Awareness or implementation experience with security standards such as ISO 27001, SOC 2, or NIST frameworks.
• Experience securing on-premise Kubernetes clusters and containerized environments.