Principal Security Software Engineer (Elasticsearch)

Elastic as a Principal Security Software Engineer, where you will lead the architecture and design of Elasticsearch's main security features.

Responsibilities

• You will work closely with engineering and product leaders, ensuring high-performance security at all levels.
• Your responsibilities will include owning core security initiatives, optimizing security performance, applying cryptographic solutions, and collaborating with peers across the company.
• You will also drive vulnerability management efforts and mentor other engineers.
• Lead the architecture and design of Elasticsearch's main features, focusing on authentication, authorization, and tenant isolation.
• Own core security initiatives from architecture to production, leading the technical design, plan, and execution for major security components.
• Collaborate with peers across the company to embed security into new customer features from the outset, and drive vulnerability management efforts.
• You can work autonomously, drive decisions, and lead a distributed team by leveraging asynchronous, direct, and transparent communication

Requirements

• You have proven experience in designing and building systems for authorization that can scale. This includes deep experience designing scalable RBAC/ABAC models and token validation pipelines. It includes permission compilation and distributed cache invalidation strategies
• You have a proven track record of using AI to accelerate development, debug complex systems, and optimize code, while still owning the final outcomes
• You have deep knowledge of Java internals and JVM memory management. You understand how concurrency models work. You can write code that is high-performance, thread-safe, and lock-free. This experience includes working with large open-source and enterprise codebases
• You have a deep knowledge of edge identity protocols (OAuth 2.0, SAML)
• You have a solid comprehension of distributed systems security, including node-to-node mutual trust, zero-trust transport, partition tolerance, and cluster state propagation
• You possess the ability to collaborate across functions and teams and seamlessly transition between different projects, codebases, or teams based on business priorities
• Knowledge of cipher suites, TLS handshakes, and PKI/certificate lifecycle management
• Cryptographic methods considering memory usage and delays
• Familiarity with the implications of Post-Quantum Cryptography (PQC) and readiness to support the migration of services to quantum-resistant cryptographic algorithms

Preferred

• Hands-on experience mapping engine-level technical controls to FedRAMP (Moderate/High), FIPS 140, and SOC 2 requirements
• Experience working on the internals of a data store or search engine

Benefits

• Enjoy benefits such as fully paid health coverage, flexible location and schedule, generous vacation days, parental leave, and charitable giving matching.