Company Overview

Orbis is a technology company that delivers sovereign intelligence and decision capabilities to the United States Government and its allies. We convert complex information and operational systems into decisive outcomes, giving public institutions and critical enterprises the tools to move faster, see clearer, and act first in an increasingly contested world.

We are not a consulting firm and not a systems integrator. Every Orbis team is built around practitioners who have operated at the mission edge, and every engagement is judged on one thing: whether it produces working capability, not slide decks. Solutions forged from experience; that is how we build, and it is how we hire.

Job Summary

Orbis is seeking a Staff Security Engineer to drive the security and trust architecture across Catalyst, our secure multi-cluster service mesh platform. You will set the patterns other engineers follow for authentication, authorization, and tenant isolation. We are looking for someone who has built platform-wide security architecture and wants to set technical direction for a team building critical infrastructure.

TRAVEL: International travel to Middle East and geopolitical hot zones, up to 25% per calendar year is required. Please apply only if you can meet this requirement.

Key Responsibilities

Define the architecture for Catalyst's authentication and authorization layer (e.g., OIDC, OAuth2, and SAML, RBAC, ABAC models) and help set the patterns other engineers build against
Drive reliability and security strategy for the trust layer: define SLOs and SLAs for authn/authz latency and availability, lead incident response for credential and access-control incidents, and design for safe revocation under partial failure
Participate in on-call and incident response for our data platform including leading post-incident reviews, triage, prevention, and mitigation
Define and implement secure-by-default developer patterns and infrastructure primitives to reduce security friction and eliminate common vulnerability classes (e.g., standardized authentication middleware, automated credential lifecycle management, and hardened service-to-service communication patterns using mTLS and SPIFFE/SPIRE)
Define the QA philosophy and test strategy for the security layer, including threat modeling, adversarial test coverage, and session and revocation edge cases, and own the security quality gates in the deployment pipeline (e.g., integrating SCA, SAST, and container image scanning)
Implement and review pull requests across session, token, and authentication systems ensuring that security, testing, and operational readiness
Architect and implement encryptions at rest and in transit, key hierarchies, and HSM/KMS integration (e.g., using HashiCorp Vault or cloud-native KMS providers)
Lead team rituals such as design discussions to improve culture, surface new ideas, risks, and strategies across the team
Partner with security and IT teams to align on networking, observability, and identity patterns (e.g., including VPCs, network policies, IAM, and service mesh configurations) and ensure compliance with relevant industry standards (e.g., OWASP, ISO 27001, NIST, SOC 2)
Lead offensive security and vulnerability discovery efforts (e.g., directing third-party penetration tests, conducting internal red-team exercises, regular security assessments and penetration testing) against core platform components to identify and remediate vulnerabilities
Being a force multiplier by championing security programs, patterns, standards, and documentation
Grow team capability through deliberate coaching; mentor senior engineers on secure API and protocol design
Travel up to 25% for customer engagement, architecture reviews, or team collaboration (Middle East)

Required Qualifications

Active security clearance Top Secret Clearance required.
7+ years of experience, with a track record of shaping whole platform or infrastructure security areas rather than individual features
Deep hands-on experience designing and operating mTLS and TLS-based trust in distributed, multi-service systems, including certificate issuance, x509 validation, CA bundle management, and key rotation