Principal Engineer for Security Architecture

NVIDIA DGX Cloud is an AI Factory designed to power the next generation of AI and industrial-scale breakthroughs. As a Principal Engineer for Security Architecture, within our Security Engineering organization, you will own a core security domain of the AI factory: the architecture, the paved road that delivers it, and much of the code underneath.

Responsibilities:

• Own a Security Domain End to End: Take architectural ownership of a core domain of DGX Cloud security, from the design through the system running in production.
• Embed with the Teams Building It: Join the design early, write the code, and help land it.
• Build Paved Roads, Not Gates: Engineer the secure path into the platform so that it is also the easy path.
• Engineer Classes of Risk Out of Existence: Finding a vulnerability is 4% of the work; building the system where it cannot happen again is the other 96%.
• Threat Model and Attack the Design: Run deep-dive threat models across the substrate, the orchestration layer, and the tenancy boundary, then go after your own designs offensively and feed what you find back into the baselines, the guardrails, and the detections.
• Carry the Bar into Execution: Turn the DGX Cloud security bar into reference architectures, requirements, and golden paths teams can build against.
• Multi-Functional Collaboration: Partner with DGX Cloud platform, production engineering, and network security teams, and with NVIDIA's central security organization, to make the secure path real in CI/CD and in the hardware lifecycle.

Requirements:

• Security and Infrastructure Engineering: Experience (typically 15+ years) across software engineering, SRE, infrastructure, and security engineering.
• Production-Grade Coding: A strong software engineering background with the ability to write clean, maintainable, and well-tested code.
• Emerging Technology: You work with what is new rather than waiting for it to settle.
• Security Architecture in Practice: Designs you own that actually got built and run, in areas like multi-tenant isolation, identity and access, policy enforcement, vulnerability management, or detection engineering.
• Threat Modeling and System Design: Proven ability to build threat models for complex distributed systems, identify the architectural gaps rather than only the bugs, and engineer the solutions that close them.
• Distributed Systems and Linux Depth: Cloud-native architecture, container orchestration (Kubernetes), and hands-on Linux systems security including kernel-level primitives (eBPF, AppArmor, or SELinux).
• Influence Without Authority: Experience landing designs through teams you do not own, in environments where credibility and relationships, not org charts, determine whether the work ships.

Nice to Have:

• HPC/AI Security: Experience securing high-performance computing environments, RDMA-based networks, large GPU fleets, or GPU-specific security challenges.
• Cloud-Native Identity and Attestation: Expertise in workload identity frameworks (e.g., SPIFFE/SPIRE), hardware root of trust (TPM/HSM) integration, or confidential computing.
• Offensive Depth Turned Defensive: Real exploitation, red team, or security research experience that you have converted into engineering: the controls, guardrails, and detections that closed what you found for good.
• Open Source Impact: Notable contributions to security-focused open-source projects or a track record of engineering-focused security research.

Your base salary will be determined based on your location, experience, and the pay of employees in similar positions. The base salary range is 272,000 USD - 431,250 USD. You will also be eligible for equity and benefits.