Security Engineer - Calix Cloud

The Calix platform enables Communication Service Providers (CSPs) of all sizes to transform and future-proof their businesses. Through real‑time data, automation, and actionable insights delivered via Calix One— our cloud-first, AI-powered platform — CSPs can simplify operations, collapse cost, and accelerate innovation. Calix One brings together the automation of everything and the experience of one, empowering customers to deliver differentiated subscriber experiences while driving acquisition, loyalty, and revenue growth.

This is the Calix mission: to enable CSPs of all sizes to simplify, innovate, and grow, strengthening both their businesses and the communities they serve. We’re at the forefront of a once in a generational change in the broadband industry. Join us as we innovate, help our customers reach their potential, and connect underserved communities with unrivaled digital experiences. Calix is where passionate innovators come together with a shared mission: to reimagine broadband experiences and empower communities like never before.

As a true pioneer in broadband technology, we ignite transformation by equipping service providers of all sizes with an unrivaled platform, state‑of‑the‑art cloud technologies, and AI‑driven solutions that redefine what’s possible. Every tool and breakthrough we offer is designed to simplify operations and unlock extraordinary subscriber experiences through innovation. We’re looking for a Staff Security Engineer to define and strengthen the trust architecture connecting our devices, customers, and cloud platform.

In this highly influential, hands‑on role, you’ll serve as a senior technical authority across device identity, PKI, cloud and workload identity, secure device‑to‑cloud communications, and embedded security. You’ll partner across device, network, mobile, and cloud engineering teams to design resilient security architecture, pressure‑test it through threat modeling and offensive testing, and drive solutions from design through production.

What you’ll do Design and run our PKI on GCP: offline root, HSM‑backed issuing CAs in Certificate Authority Service, certificate profiles, and key ceremonies. Define device identity: unique keys in a secure element or TPM, factory provisioning, field enrollment (for example EST), rotation, revocation, and a tested plan for CA key compromise. Architect workforce, workload and customer identity: SSO and Workforce Identity Federation, Workload Identity Federation instead of service account keys, and OAuth
2.0 and OIDC flows for apps and devices. Secure the path from device to cloud: mutualTLS, per‑device authorization, and protection against replay, cloned devices and fleet‑wide denial of service. Own security of the ingestion layer on GCP (self‑operated MQTT brokers and gateways on GKE feeding Pub/Sub, Dataflow and Big Query), since Cloud IoT Core was retired in 2023. Secure remote commands and over‑the‑air updates so a compromised cloud account cannot push malicious firmware to the fleet.

Set on‑device requirements: secure boot, signed and rollback‑protected firmware, encrypted storage, locked debug ports, and a hardened OS image. Test devices hands‑on: firmware analysis, hardware and local‑interface attacks (Bluetooth, Wi‑Fi, USB, serial), and protocol fuzzing; secure the companion mobile apps. Govern the firmware supply chain: SBOMs, vulnerability management, signing‑key custody, and manufacturer and silicon‑vendor assessments. Build threat models for the full device, app, gateway and cloud system (STRIDE, attack trees, MITRE ATTACK), and run pentests, red‑team and purple‑team exercises.

Set GCP guardrails: organization policy, VPC Service Controls, IAM, Cloud KMS, GKE hardening, Binary…