Staff Security Engineer (GCP)

Location: Remote - USA

Base pay: 136,000–231,000 USD annually for all other US locations; 156,400–265,700 USD annually for the San Francisco Bay Area. The role may also be eligible for a bonus.

Company

hirify.global provides hirify.global One, a cloud-first, AI-powered broadband platform that uses real-time data and automation to help communication service providers simplify operations, innovate, and improve subscriber experiences.

What you will do

• Design and operate GCP PKI, including offline roots, HSM-backed issuing CAs, certificate profiles, key ceremonies, lifecycle automation, and compromise recovery.
• Define device, workforce, workload, and customer identity architectures, including secure provisioning, federation, OAuth 2.0, OIDC, and SSO.
• Secure device-to-cloud communications, MQTT/GKE ingestion, remote commands, OTA updates, and per-device authorization.
• Set and validate embedded security requirements such as secure boot, signed rollback-protected firmware, encrypted storage, locked debug ports, and hardened OS images.
• Perform firmware, hardware, interface, mobile-app, protocol, threat-modeling, penetration, red-team, and purple-team assessments.
• Establish GCP guardrails, secure CI/CD and data pipelines, firmware supply-chain controls, compliance mappings, incident escalation, mentoring, and executive briefings.

Requirements

• BS or MS in computer science, information security, or cryptography, or equivalent experience.
• 10+ years in security engineering, with deep ownership of at least two areas: PKI, identity and access, device security, or cloud security architecture.
• Deep PKI expertise covering X.509 profiles, CA hierarchy design, HSM and key management, certificate lifecycle automation, revocation at scale, EST, SCEP, ACME, and GCP Certificate Authority Service or a comparable managed CA.
• Deep identity expertise with OAuth 2.0, OIDC, SAML, SSO, federation, enterprise IdPs, and token and session security for applications and devices.
• Strong GCP security experience with IAM, Workload Identity Federation, Cloud KMS, VPC Service Controls, GKE and container security, Security Command Center, BigQuery, Dataflow, Datastream, and Kafka.
• Applied experience securing device-to-cloud communications with mutual TLS, MQTT, gRPC, broker and gateway hardening, and OTA update integrity.
• Hands-on device and embedded security experience with secure boot, TPM or secure elements, firmware analysis, hardware debug interfaces, and Android and iOS mobile-app security.
• Hands-on offensive security and full device-to-cloud threat modeling experience; ability to write tooling in Python, Go, or a similar language.
• Experience with CI/CD, DevSecOps, ISO 27001, SOC 2, NIST CSF, and CIS Controls, plus the ability to influence architecture across teams and brief clearly.

Culture & Benefits

• Work remotely within the USA.
• Work on AI, telecom, cloud, and security projects affecting millions of users.
• Collaborative environment with continuous learning and growth.
• Competitive benefits, vacation package, and potential bonus eligibility.