Senior Platform Security and Reliability Engineer

Kairos Power is a nuclear energy technology and engineering company dedicated to enabling the world’s transition to clean energy. Their mission is to improve people’s quality of life while protecting the environment through the commercialization of the fluoride-salt-cooled, high-temperature reactor (FHR).

Kairos Power is seeking a Senior Platform Security and Reliability Engineer to join a small software and infrastructure team supporting design, research, and development organizations. This is a hands-on individual contributor role focused on owning the security baseline and reliability posture of cloud and high-performance computing platforms.

You will set the technical direction for platform security controls across AWS and Google Cloud, including identity and secrets management, machine image security, network security, and observability architecture. You will lead the migration of legacy cloud workloads, manage cost visibility and resource guardrails, and lead response to both availability and security incidents. The role emphasizes simple, proportionate designs using standard, well-supported technologies.

Responsibilities

Security Baseline and Platform Controls

• Define, implement, and maintain the security baseline for cloud and Linux platforms, including operating system hardening, benchmark configuration, and secure defaults for new environments.
• Own platform security controls in AWS and Google Cloud, including account and project structure, guardrails, service configuration, logging, and both preventative and detective controls.
• Design and enforce least-privilege access patterns across cloud accounts, Linux systems, and internally hosted engineering services.
• Own the security of machine image pipelines, including image hardening, vulnerability scanning, patch currency, automated image testing, versioned releases, and rollback.
• Assess new platform technologies for security impact before adoption, and document the reasoning behind each decision.

Identity, Secrets, and Certificates

• Own identity and access management across cloud and self-hosted services, including authentication, authorization, federation, and periodic access review.
• Manage the full lifecycle of secrets, including storage, distribution, rotation, and revocation, and eliminate credentials embedded in code or configuration.
• Own certificate lifecycle, including issuance, automated renewal, expiry monitoring, and trust chain management.
• Automate access provisioning and deprovisioning to ensure entitlements reflect current needs.

Compliance Automation

• Translate internal security requirements into automated checks that run continuously rather than as periodic manual reviews.
• Build and maintain resource inventory and configuration data across cloud and self-hosted systems to ensure coverage gaps are visible.
• Automate the collection of control evidence and reporting of exceptions, reducing manual effort required to demonstrate controls are working.
• Track identified findings to closure and drive recurring findings toward systemic fixes.

Reliability, Recovery, and Incident Leadership

• Define service health indicators and service-level objectives for platform services, and hold the platform to them.
• Engineer automated recovery and self-healing mechanisms for routine failure modes.
• Own backup, restoration, and disaster recovery for critical services, including documented, rehearsed, and verified procedures.
• Lead response to availability and security incidents, coordinating diagnosis, containment, communication, and follow-up actions.
• Conduct blameless post-incident reviews and convert findings into concrete engineering work.

Observability Architecture

• Own the observability architecture for platform services, including metrics, logs, retention, and access.
• Build and maintain dashboards in AWS Managed Grafana and ensure alerting is actionable.
• Ensure security-relevant events are collected, retained, and searchable, and that alerting distinguishes meaningful signal from routine activity.

Network and Connectivity Security

• Design and operate secure networking for self-hosted and cloud services, including segmentation, DNS, TLS, routing, firewalls, VPN, and zero-trust connectivity.
• Own ingress and egress control for engineering and scientific computing environments, removing overly permissive access paths.
• Document and standardize how engineers connect to internal services for consistent connectivity.

Cloud Lifecycle and Cost Governance

• Lead migration of legacy cloud workloads into supported, standardized environments, including data movement, cutover planning, and verification.
• Drive retirement and consolidation of unsupported and duplicative services, including decommissioning, archival, and infrastructure removal.
• Own cloud and high-performance computing cost visibility, including cost attribution, budgets, alerting on unexpected spend, and resource guardrails.
• Evaluate cost and reliability tradeoffs of platform changes, supporting recommendations with measured data.

Engineering Practice and Mentorship

• Write, test, and maintain platform and security automation in Python or another general-purpose language, applying engineering standards expected of application code.
• Lead infrastructure design review and code review, providing feedback that measurably improves team quality.
• Mentor engineers, transfer knowledge deliberately, and remove single-person dependencies through documentation and shared ownership.
• Evaluate build-versus-buy decisions, selecting standard, well-supported technologies over custom infrastructure unless requirements demand otherwise.
• Choose the smallest design that meets actual requirements and identify technical debt, premature abstraction, and unnecessary complexity.
• Collaborate with nuclear and non-software engineers, explaining security requirements in terms of their work.