{"id":606784,"url":"https://alion.io/job/ddn-lead-engineer-security-architecture","title":"Lead Engineer – Security Architecture","company":{"id":672909,"name":"DDN","domain":"ddn.com","url":"https://alion.io/company/ddn","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":98,"open_postings":6,"ghost_share":0,"stale_share":0,"repost_share":0.167,"time_to_fill_p50_days":41,"computed_at":"2026-10-16T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Santa Clara, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":225000,"max":275000,"currency":"USD","period":"year","gross":null,"usd_annual":275000},"salary_estimate":null,"experience_years_min":12,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Amazon S3","optional":false},{"name":"Anomaly Detection","optional":false},{"name":"IAM","optional":false},{"name":"Keycloak","optional":false},{"name":"KV Cache","optional":false},{"name":"LDAP","optional":false},{"name":"Least Privilege","optional":false},{"name":"PKI","optional":false},{"name":"Platform Engineering","optional":false},{"name":"Rest API","optional":false},{"name":"SIEM","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Zero Trust","optional":false},{"name":"FedRAMP","optional":true},{"name":"ISO 27001","optional":true},{"name":"Linux","optional":true},{"name":"SOC 2","optional":true}],"status":"live","first_seen_at":"2026-07-31T20:17:36Z","employer_posted_date":"2026-10-02","last_verified_at":"2026-10-17T00:04:27Z","board_verified":true,"closed_at":null,"days_open":77,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":77},"description":"DDN is seeking a highly accomplished Principal Engineer - Security Architecture to define and drive the security strategy for next-generation distributed storage platforms spanning S3-compatible object storage, POSIX-compliant file systems, and KV cache-based data services. This role is responsible for architecting secure-by-design systems across the data path, control plane, and ecosystem/protocol layers that power high-performance, multi-tenant, AI-driven infrastructure at massive scale.\nAs a senior technical leader, you will partner closely with storage architects, protocol engineers, platform teams, and security stakeholders to embed advanced security principles into every layer of the platform lifecycle. You will influence long-term architectural direction, establish foundational security standards, and guide implementation across globally distributed engineering organizations.\nThe ideal candidate combines deep expertise in distributed systems security, cryptography, identity and access management, multi-tenant architectures, and infrastructure security with the ability to drive cross-functional technical strategy and execution.\nKey Responsibilities\nDefine and lead the long-term security architecture strategy for distributed storage platforms, including S3-compatible object storage, POSIX/NFS file systems, and KV cache-based data services.\n\nEstablish security architecture standards and secure-by-design principles across data path, control plane, orchestration, and protocol layers.\n\nPartner with Data Path engineering teams to secure high-performance data movement across storage tiers, including encryption, integrity verification, secure I/O handling, and low-latency protection mechanisms.\n\nDrive security architecture reviews, threat modeling, and Secure Software Development Lifecycle (SSDLC) practices across platform engineering initiatives.\n\nArchitect enterprise-grade Identity and Access Management (IAM) frameworks integrating LDAP, Active Directory, OIDC, Keycloak, SSO, MFA, federation, and delegated authorization models.\n\nDesign and govern fine-grained authorization systems leveraging RBAC, ABAC, metadata-aware policy enforcement, and tenant-scoped access controls.\n\nDefine scalable multi-tenant isolation architectures across namespaces, encryption boundaries, policies, quotas, and workload segregation domains while enforcing least privilege principles.\n\nCollaborate with Control Plane engineering teams to design secure APIs, authentication workflows, policy orchestration, tenant lifecycle management, and platform governance controls.\n\nPartner with Protocol and Ecosystem teams to secure S3, POSIX/NFS, and related interfaces, including request signing, session security, endpoint hardening, and protocol-level protections.\n\nLead platform-wide encryption and key management strategies for data at rest and in transit, including BYOK, tenant-scoped keys, dataset-level encryption policies, KMIP integration, and external KMS interoperability.\n\nDefine observability, telemetry, logging, auditing, and anomaly detection strategies to identify abnormal behavior, insider threats, and potential data exfiltration risks.\n\nDrive adoption of Zero Trust security principles across distributed systems and infrastructure components.\n\nProvide technical leadership, mentorship, and architectural guidance across cross-functional engineering teams, influencing secure implementation practices and platform evolution.\n\nRepresent security architecture initiatives in executive, customer, compliance, and strategic partner discussions as needed.\n\nRequired Qualifications\nBachelor’s or Master’s degree in Computer Science, Engineering, Cybersecurity, or a related technical field.\n\n12+ years of experience in security architecture, distributed systems security, infrastructure security, or large-scale platform engineering.\n\nProven track record designing and securing large-scale distributed systems, storage platforms, or cloud-native infrastructure.\n\nDeep understanding of distributed system architectures, including data path and control plane security models.\n\nExtensive expertise in cryptography, encryption frameworks, secure key management systems, and PKI architectures.\n\nStrong experience integrating external KMS platforms using KMIP or equivalent protocols.\n\nAdvanced knowledge of IAM frameworks, including RBAC, ABAC, SSO, MFA, federation, delegated authorization, and policy-driven access control systems.\n\nExperience integrating enterprise identity providers such as LDAP, Active Directory, OIDC, and SAML-based systems.\n\nExpertise in secure API design, TLS 1.3, mutual TLS, request signing mechanisms (e.g., SigV4), and service-to-service authentication models.\n\nExperience designing secure multi-tenant platforms with strong isolation, governance, and policy enforcement mechanisms.\n\nStrong understanding of security observability, logging, auditability, SIEM integration, and compliance-driven monitoring architectures.\n\nDemonstrated ability to influence technical direction and drive cross-functional architectural initiatives across engineering organizations.\n\nPreferred Qualifications\nExperience securing S3-compatible object storage, POSIX/NFS file systems, or high-performance distributed storage environments.\n\nFamiliarity with AI/ML infrastructure security, KV cache architectures, memory tiering systems, and GPU-centric distributed environments.\n\nExperience integrating and managing security solutions across large-scale infrastructure platforms, including cloud, network, and application security domains.\n\nHands-on experience with BYOK architectures, tenant-scoped key management, and cryptographic isolation models.\n\nExperience implementing ABAC using metadata classification, tagging, and contextual policy evaluation.\n\nStrong background in Zero Trust architecture and distributed systems security engineering.\n\nKnowledge of secure deletion techniques, including cryptographic erasure and secure lifecycle management.\n\nFamiliarity with compliance frameworks such as SOC 2, ISO 27001, NIST, FedRAMP, and enterprise security governance standards.\n\nExperience designing security controls for high-throughput, low-latency distributed systems.\n\nFamiliarity with anomaly detection, behavioral analytics, and advanced security telemetry platforms.\n\nExperience with Linux systems, scripting, automation, DevSecOps workflows, and infrastructure security tooling.","description_format":"text","description_chars":6417,"description_truncated":false,"requirements":{"experience_years_min":12,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Enterprise Storage Systems","Servers & Data Center Hardware"],"lifecycle":[{"event":"open","at":"2026-09-10T18:00:29Z"}],"visa":[],"liveness":{"score":27,"band":"fade","label":"Fading","p_open":1,"p_active":0.739,"p_room":0.36,"age_days":76,"expected_fill_days":41,"reasons":["conf:3","urgency","velocity","win:tail","crowd:"],"computed_at":"2026-10-16T05:45:00Z"},"pay":{"stated_usd_annual":275000,"is_top_pay":true},"html_url":"https://alion.io/job/ddn-lead-engineer-security-architecture","json_url":"https://alion.io/job/ddn-lead-engineer-security-architecture.json","meta":{"generated_at":"2026-10-17T00:40:27Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":920,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":672909},"rest":"https://alion.io/mcp/rest/get_company?id=672909"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fddn-lead-engineer-security-architecture"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fddn-lead-engineer-security-architecture"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fddn-lead-engineer-security-architecture"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ddn-lead-engineer-security-architecture\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fddn-lead-engineer-security-architecture"}]}