Senior Principal Security Engineer, Gemini

• The ideal candidate will possess deep knowledge of applied cryptography, a proven track record in securing complex systems, significant experience engineering authentication and secrets management systems, and the ability to collaborate with engineering teams to achieve security objectives
• 15+ years of experience in the field
• Extensive experience in designing, deploying, and managing PKI systems, including certificate authorities, registration authorities, and certificate lifecycle management
• Deep knowledge of identity and access management technologies, protocols, and standards including WebAuthn/FIDO2, OAuth2/OpenID Connect, passkeys, PKCS #11, SAML, SCIM, RADIUS, LDAP, and X.509
• Significant experience with container orchestration technologies and relevant security considerations. We often use Kubernetes and EKS
• Significant experience with distributed systems or cloud computing, and the relevant security best practices. We often use AWS
• Significant software development experience. We often use Python or Go
• Experience building and owning high-availability critical systems or cloud-based services
• Able to self-scope, define, and manage short and long term technical goals

Desirable

• The Platform Security team secures Gemini’s infrastructure through service hardening and by developing and supporting a suite of foundational tools
• We provide secure-by-default infrastructure, consumable security services, and expert consultation to engineering teams for secure cloud and non-cloud infrastructure covering a broad problem space that includes all areas of Gemini’s platform infrastructure
• This is a critical role on the team to enhance the security of Gemini’s infrastructure through cryptographic expertise and the development of cutting edge authentication mechanisms
• This role will spearhead initiatives to improve our PKI, fortify secrets management, implement scalable MFA solutions, and architect a multi-IDP environment
• Lead PKI Architecture and Engineering: Design, implement, and maintain a robust PKI infrastructure that supports the secure issuance, management, and revocation of digital certificates
• Harden secrets management: Enhance the security posture of our secrets management platforms by implementing best practices and advanced cryptographic controls
• Provide expertise in applied cryptography: Apply cryptographic principles to ensure the confidentiality, integrity, and authenticity of sensitive data at rest and in transit
• Eliminate insecure authentication practices: Drive the removal of shared/static credentials and transition to a scalable, user-friendly multi-factor authentication (MFA) solution
• Partner with engineering teams: Collaborate with engineering teams on security architecture and implementation decisions related to access management, cryptography, and related areas of infrastructure security
• Contribute to security risk reduction: Work with AppSec, Threat Detection, Incident Response, GRC, and other security teams to identify, assess, and mitigate security risks