Note: The job is a remote job and is open to candidates in USA. Kairos Power is seeking a Senior Platform Security and Reliability Engineer to support the software and infrastructure needs of its design, research, and development organizations. The role owns the security and reliability of cloud and high-performance computing platforms, leads incident response and cloud lifecycle work, and develops controls, automation, and recovery mechanisms.
Responsibilities
- Define, implement, and maintain the security baseline for cloud and Linux platforms, including operating system hardening, benchmark configuration, and secure defaults for new environments
- Own platform security controls in AWS and Google Cloud, including account and project structure, guardrails, service configuration, logging, and both preventative and detective controls
- Design and enforce least-privilege access patterns across cloud accounts, Linux systems, and internally hosted engineering services
- Own the security of machine image pipelines, including image hardening, vulnerability scanning, patch currency, automated image testing, versioned releases, and rollback
- Assess new platform technologies for security impact before adoption, and document the reasoning behind each decision
- Own identity and access management across cloud and self-hosted services, including authentication, authorization, federation, and periodic access review
- Manage the full lifecycle of secrets, including storage, distribution, rotation, and revocation, and eliminate credentials embedded in code or configuration
- Own certificate lifecycle, including issuance, automated renewal, expiry monitoring, and trust chain management
- Automate access provisioning and deprovisioning so that entitlements reflect current need rather than accumulated history
- Translate internal security requirements into automated checks that run continuously rather than as periodic manual review
- Build and maintain resource inventory and configuration data across cloud and self-hosted systems, so that coverage gaps are visible rather than assumed
- Automate the collection of control evidence and the reporting of exceptions, and reduce the manual effort required to demonstrate that controls are working
- Track identified findings to closure, and drive recurring findings toward systemic fixes rather than repeated manual remediation
- Define service health indicators and service-level objectives for platform services, and hold the platform to them
- Engineer automated recovery and self-healing so that routine failure modes resolve without human intervention
- Own backup, restoration, and disaster recovery for critical services, including restoration procedures that are documented, rehearsed, and verified
- Lead response to availability and security incidents: coordinate diagnosis and containment, communicate status and impact to affected engineers, and drive follow-up actions to closure
- Run blameless post-incident review, and convert findings into concrete engineering work rather than advisory notes
- Own the observability architecture for platform services, including metrics, logs, retention, and access
- Build and maintain dashboards in AWS Managed Grafana and alerting that is actionable rather than noisy, and route alerts to the channels where engineers actually work
- Ensure that security-relevant events are collected, retained, and searchable, and that alerting distinguishes meaningful signal from routine activity
- Design and operate secure networking for self-hosted and cloud services, including segmentation, DNS, TLS, routing, firewalls, VPN, and zero-trust connectivity
- Own ingress and egress control for engineering and scientific computing environments, and remove overly permissive access paths
- Document and standardize how engineers connect to internal services, so that connectivity is consistent rather than service-by-service
- Lead migration of legacy cloud workloads into supported, standardized environments, including data movement, cutover planning, and verification
- Drive retirement and consolidation of unsupported and duplicative services, including decommissioning, archival, and removal of the infrastructure behind them
- Own cloud and high-performance computing cost visibility, including cost attribution, budgets, alerting on unexpected spend, and resource guardrails
- Evaluate the cost and reliability tradeoffs of platform changes, and support recommendations with measured data rather than estimates
- Write, test, and maintain platform and security automation in Python or another general-purpose language, applying the same engineering standards expected of application code
- Lead infrastructure design review and code review, and give feedback that measurably improves the quality of the team’s work
- Mentor engineers, transfer knowledge deliberately, and remove single-person dependencies through documentation and shared ownership
- Evaluate build-versus-buy decisions, and select standard, well-supported technologies over custom infrastructure unless a requirement clearly demands otherwise
- Choose the smallest design that meets the actual requirement, and identify and retire technical debt, premature abstraction, and unnecessary complexity
- Collaborate with nuclear and other non-software engineers, and explain security requirements in terms of the work those engineers are trying to accomplish
Skills
- Bachelor's degree in computer science, engineering, physics, mathematics, or a related technical field, or equivalent practical experience
- 5+ years of relevant experience in platform, infrastructure, cloud, security, site reliability engineering, or a related field, including experience designing, securing, and operating production cloud infrastructure
- Demonstrated experience designing, securing, and operating production cloud infrastructure, with strong AWS experience
- Strong Linux systems experience, including administration, hardening, and troubleshooting
- Experience with infrastructure automation, including infrastructure as code, configuration management, and programming or scripting
- Experience implementing platform security controls across areas such as access management, network security, secrets management, vulnerability management, and security monitoring
- Experience designing and operating monitoring, recovery, and incident-response capabilities for production systems
- Demonstrated ability to design maintainable infrastructure and make sound technical tradeoffs involving security, reliability, performance, cost, and complexity
- Knowledge of networking fundamentals: DNS, TLS, routing, firewalls, segmentation, and remote access
- Knowledge of platform security principles, including least-privilege access, identity and access management, secrets management, vulnerability management, and defense-in-depth
- Ability to translate security, reliability, and operational requirements into practical, automated technical controls
- Ability to use monitoring, logging, metrics, and service health indicators to identify, diagnose, and improve security and reliability issues
- Ability to assess technical risk, prioritize remediation, and drive issues to sustainable resolution
- Ability to work with a highly collaborative team
- Ability to solve problems quickly and efficiently
- Ability to proactively collect, manage and transfer knowledge
- Ability to create efficiencies when working on problems, challenges, and issues, where each improvement is tied to a measurable engineering need such as safety, reliability, performance, usability, or maintainability
- Ability to exercise architectural judgment and to favor the simplest design that satisfies the requirement
- Ability to weigh security risk against engineering cost, and to explain the resulting tradeoff to the people it affects
- Ability to give direct technical feedback, to receive it, and to change course when a review identifies a better approach
- Ability to communicate clearly during incidents and to keep stakeholders informed of impact, status, and resolution
- Ability to take operational ownership of systems through their full lifecycle, including testing, documentation, and retirement
- Excellent written and verbal communication with technical and non-technical audiences
- Ability to select simple and proportionate designs, to reason about maintainability and performance, and to explain the tradeoffs behind a build-versus-buy decision
- To work in this facility, you need to be authorized by the Department of Energy to access Part 810-controlled information. Foreign nationals who are citizens of countries that are not on the Department of Energy's general authorization list (link below) are not permitted to work in our facility unless the Department of Energy issues an export control license to the company to permit that individual to have access to Part 810-controlled information
- Experience with Google Cloud, particularly the design of a new environment is desirable
- Experience with cloud cost management, including cost attribution, budgets, and resource guardrails is desirable
- Experience securing high-performance computing environments, including Slurm, Open OnDemand, MPI, or GPU-enabled workloads is desirable
- Experience with container security, including Docker and Apptainer is desirable
- Experience operating self-hosted engineering services such as GitHub Enterprise, Overleaf, application servers, or relational databases is desirable
- Experience with vulnerability management and patch automation across a fleet is desirable
- Experience automating control evidence against an established security control framework desirable
- Experience supporting scientific or engineering computing users desirable
- Advanced degree in a related technical field is desirable
Benefits
- Full-time employees (excludes interns) expect to have access to medical, dental and vision benefits for employees and their dependents.
- Full-time employees (excludes interns) expect to have access to paid vacation.
- Full-time employees (excludes interns) expect to have access to a 401(k).
- Full-time employees (excludes interns) expect to have access to pre-tax health insurance, dependent care, and commuter benefits (FSA).
- Remote work
Company Overview