Staff Security Engineer

Calix

. Define and strengthen trust architecture connecting devices, customers and the cloud platform .

Posted 11/3/2026full-timeRemote • United StatesLead💰 $136,000 - $231,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in security engineering with a focus on PKI, identity and access management, and cloud security architecture. Proficient in designing secure device-to-cloud communications and implementing robust security measures across various platforms and protocols.

Highest-signal resume keywords

PKI ExpertiseGCP Security ExperienceIdentity ExpertiseHands-On Device Security SkillsOffensive Security Skills

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

PKIIdentity And Access ManagementCloud Security ArchitectureFirmware AnalysisSecure BootToken And Session SecurityThreat ModelingPython ProgrammingCI/CD SecurityVulnerability Management

Soft Skills

Clear Writing SkillsMentoring

Tools & Technologies

GCPIAMCloud KMSGKEBigQueryDataflowMQTTOAuth 2.0OIDCSAML

Certifications & Qualifications

BS Or MS In Computer ScienceInformation SecurityCryptography

Industry Keywords

ISO 27001SOC 2NIST CSFCIS ControlsHSMCertificate Lifecycle AutomationMutual TLSOTA Update IntegrityDevice IdentitySecurity Command Center

Tech Stack

Tools & technologies

AndroidBigQueryCloudGoogle Cloud PlatformGRPCiOSKafkaPythonGo

About the role

Key responsibilities & impact

Define and strengthen trust architecture connecting devices, customers and the cloud platform
Design and run PKI on GCP, including offline root, HSM-backed issuing CAs, certificate profiles and key ceremonies
Define device identity, factory provisioning, field enrollment, rotation, revocation and CA key-compromise response
Architect workforce, workload and customer identity using SSO, Workforce Identity Federation, OAuth 2.0 and OIDC
Secure device-to-cloud communications with mutual TLS, per-device authorization and protections against replay, cloned devices and fleet-wide denial of service
Own security of the GCP ingestion layer using MQTT brokers and gateways on GKE feeding Pub/Sub, Dataflow and BigQuery
Secure remote commands and over-the-air updates
Set on-device security requirements including secure boot, signed and rollback-protected firmware, encrypted storage, locked debug ports and hardened OS images
Perform hands-on firmware analysis, hardware and local-interface attacks, protocol fuzzing and companion mobile-app security
Govern the firmware supply chain, including SBOMs, vulnerability management, signing-key custody and vendor assessments
Build threat models and conduct penetration tests, red-team and purple-team exercises
Set GCP guardrails across organization policy, VPC Service Controls, IAM, Cloud KMS, GKE, Binary Authorization, CI/CD and data pipelines
Map controls to ISO 27001, SOC 2, NIST CSF, CIS Controls, ETSI EN 303 645, NIST IR 8259, GSMA baseline controls and FCC CPNI rules
Serve as escalation point for security decisions and incidents, mentor senior engineers and brief executives

Requirements

What you’ll need

BS or MS in computer science, information security or cryptography, or equivalent experience
10+ years in security engineering
Deep ownership of at least two of: PKI, identity and access, device security, or cloud security architecture
PKI expertise including X.509 profiles, CA hierarchy design, HSM and key management, certificate lifecycle automation, revocation at scale, and EST, SCEP and ACME
Experience with GCP Certificate Authority Service or a comparable managed CA
Identity expertise including OAuth 2.0, OIDC, SAML, SSO and federation
Experience running or integrating an enterprise IdP
Experience designing token and session security for apps and devices
Strong GCP security experience with IAM, Workload Identity Federation, Cloud KMS, VPC Service Controls, GKE and container security, Security Command Center, BigQuery, Dataflow, Datastream and Kafka
Knowledge of mutual TLS, MQTT and gRPC security, broker and gateway hardening, and OTA update integrity
Hands-on device and embedded security skills, including secure boot, TPM or secure element use, firmware analysis, hardware debug interfaces, and Android and iOS mobile app security
Hands-on offensive security skills and ability to threat-model a full device-to-cloud system
Ability to write tooling in Python, Go or similar
Experience with CI/CD and DevSecOps security
Experience with ISO 27001, SOC 2, NIST CSF and CIS Controls
Record of influencing architecture across multiple teams
Clear writing and briefing skills

Benefits

Comp & perks

Competitive Benefits and Vacation package
Opportunity to work on cutting-edge projects impacting millions of users
Collaborative culture with continuous learning and growth
Potential eligibility for a bonus