Description
As a Principal Engineer leading software security, you will be a primary technical authority responsible for defining and driving the security architecture across our software platforms and services.
You will bridge the gap between high-level security strategy and hands-on engineering execution, ensuring that our products are secure from the cloud to the box.
Responsibilities:
- Design trust boundaries, sandboxing models, and execution guardrails for autonomous application agents and LLM tool-calling workflows.
- Architect granular authentication, authorization, and least-privilege scoping for Model Context Protocol (MCP) servers, tool registries, and external integrations.
- Mitigate emerging AI threat vectors (e.g., OWASP Top 10 for LLMs, indirect prompt injection, tool hijacking, credential harvesting, and context leakage).
- Establish spec-driven security standards across application contracts (OpenAPI, TypeSpec, gRPC/Protobuf), embedding authentication schemes, data sanitization, and authorization scopes directly into machine-readable specs.
- Implement automated security contract testing and static/dynamic schema validation to detect authorization bypasses, Broken Object Level Authorization (BOLA), and injection vulnerabilities prior to deployment.
- Lead comprehensive architectural threat modeling for critical application tiers, distributed business logic, and multi-tenant data boundaries.
- Create reusable, hardened software design patterns, cryptographic utilities, and session management frameworks for application engineering teams.
- Architect and scale automated security gates in CI/CD pipelines (SAST, DAST, IAST, software composition analysis, container image signing, and SBOM tracking).
- Define policy-as-code (e.g., OPA/Rego, Cedar) frameworks to enforce deterministic security baselines across service deployments.
- Serve as the principal technical escalation point for complex application security architecture reviews and critical vulnerability disclosures.
- Mentor senior software engineers on defensive coding practices, modern API security standards, and zero-trust application design.
Requirements:
- Bachelor’s degree in Computer Science, Engineering, or a related technical field.
- 15+ years of experience in software engineering and application security architecture, including designing, securing, and operating distributed applications.
- Experience in application security frameworks such as OWASP Top 10, OWASP API Top 10, CWE/SANS 25, OR zero-trust application patterns.
- Experience in identity and access governance including one or more of OAuth 2.0, OIDC, SAML, mTLS, SPIFFE/SPIRE, or fine-grained authorization models (RBAC, ABAC, ReBAC).
- Experience in at least one backend language (Python, Go, TypeScript/Node.js, Rust, or Java).
- Experience integrating security controls into cloud-native architectures such as Kubernetes, AWS/GCP/Azure, API gateways, or service meshes.
Benefits:
- Medical, dental, and vision insurance
- 401(k) plan with a Cisco matching contribution
- Paid parental leave
- Short and long-term disability coverage
- Basic life insurance
- Paid time away (vacation, holidays, sick time)
- Opportunities for professional growth and development