# Principal Engineer, Software Security

**Company**: Cisco
**Experience**: senior
**Job type**: full-time
**Salary**: $233,900.00 to $330,400.00
**Category**: Engineering
**Industry**: Technology

**Apply**: https://cisco.wd5.myworkdayjobs.com/en-US/Cisco_Careers/job/San-Jose-California-US/Principal-Software-Engineer---Application-Security---AI-Trust-Architecture_2021755?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_140ee69c-828

## Description

As a Principal Engineer leading software security, you will be a primary technical authority responsible for defining and driving the security architecture across our software platforms and services.

You will bridge the gap between high-level security strategy and hands-on engineering execution, ensuring that our products are secure from the cloud to the box.

Responsibilities:

- Design trust boundaries, sandboxing models, and execution guardrails for autonomous application agents and LLM tool-calling workflows.

- Architect granular authentication, authorization, and least-privilege scoping for Model Context Protocol (MCP) servers, tool registries, and external integrations.

- Mitigate emerging AI threat vectors (e.g., OWASP Top 10 for LLMs, indirect prompt injection, tool hijacking, credential harvesting, and context leakage).

- Establish spec-driven security standards across application contracts (OpenAPI, TypeSpec, gRPC/Protobuf), embedding authentication schemes, data sanitization, and authorization scopes directly into machine-readable specs.

- Implement automated security contract testing and static/dynamic schema validation to detect authorization bypasses, Broken Object Level Authorization (BOLA), and injection vulnerabilities prior to deployment.

- Lead comprehensive architectural threat modeling for critical application tiers, distributed business logic, and multi-tenant data boundaries.

- Create reusable, hardened software design patterns, cryptographic utilities, and session management frameworks for application engineering teams.

- Architect and scale automated security gates in CI/CD pipelines (SAST, DAST, IAST, software composition analysis, container image signing, and SBOM tracking).

- Define policy-as-code (e.g., OPA/Rego, Cedar) frameworks to enforce deterministic security baselines across service deployments.

- Serve as the principal technical escalation point for complex application security architecture reviews and critical vulnerability disclosures.

- Mentor senior software engineers on defensive coding practices, modern API security standards, and zero-trust application design.

Requirements:

- Bachelor’s degree in Computer Science, Engineering, or a related technical field.

- 15+ years of experience in software engineering and application security architecture, including designing, securing, and operating distributed applications.

- Experience in application security frameworks such as OWASP Top 10, OWASP API Top 10, CWE/SANS 25, OR zero-trust application patterns.

- Experience in identity and access governance including one or more of OAuth 2.0, OIDC, SAML, mTLS, SPIFFE/SPIRE, or fine-grained authorization models (RBAC, ABAC, ReBAC).

- Experience in at least one backend language (Python, Go, TypeScript/Node.js, Rust, or Java).

- Experience integrating security controls into cloud-native architectures such as Kubernetes, AWS/GCP/Azure, API gateways, or service meshes.

Benefits:

- Medical, dental, and vision insurance

- 401(k) plan with a Cisco matching contribution

- Paid parental leave

- Short and long-term disability coverage

- Basic life insurance

- Paid time away (vacation, holidays, sick time)

- Opportunities for professional growth and development

## Skills

### Required
- OWASP Top 10
- Zero-trust application patterns
- OAuth 2.0
- OIDC
- SAML
- mTLS
- SPIFFE/SPIRE
- RBAC
- ABAC
- ReBAC
- Python
- Go
- TypeScript/Node.js
- Rust
- Java
- Kubernetes
- AWS/GCP/Azure
- API gateways
- Service meshes

### Nice to have
- Model Context Protocol (MCP)
- Policy-as-code engines (Open Policy Agent, AWS Cedar, Oso/Polar)
- Custom linter/SAST rules (Semgrep, CodeQL)
- Application security research
- CVE publications
- Open-source security tooling
- Industry working groups (OWASP, CNCF Security, OASIS)
- Security certifications (CISSP, CSSLP, CCSP, AWS Certified Security)

---

Source: [Apply at cisco.wd5.myworkdayjobs.com](https://cisco.wd5.myworkdayjobs.com/en-US/Cisco_Careers/job/San-Jose-California-US/Principal-Software-Engineer---Application-Security---AI-Trust-Architecture_2021755?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)