Senior Security Architect: Distributed Storage & IAM

Ddn; Sacramento (CA); On-site; USD 180,000 - 260,000; Full time

Job summary

DDN seeks a Principal Engineer - Security Architecture to define the security strategy for next-generation distributed storage platforms. Lead secure-by-design principles across data path, control plane, and protocol layers while guiding cross-functional teams worldwide.

The role requires deep expertise in cryptography, IAM, multi-tenant isolation, and platform governance, with strong collaboration across data path, protocol, and ecosystem teams.

Qualifications

• Bachelor’s or Master’s degree in Computer Science, Engineering, Cybersecurity, or a related field.
• 12+ years of experience in security architecture, distributed systems security, infrastructure security, or large-scale platform engineering.
• Proven track record designing and securing large-scale distributed systems, storage platforms, or cloud-native infrastructure.
• Deep understanding of distributed system architectures, including data path and control plane security models.
• Extensive expertise in cryptography, encryption frameworks, secure key management systems, and PKI architectures.
• Advanced knowledge of IAM frameworks, including RBAC, ABAC, SSO, MFA, federation, delegated authorization, and policy-driven access control systems.

Responsibilities

• Define and lead the long-term security architecture strategy for distributed storage platforms, including S3-compatible object storage, POSIX/NFS file systems, and KV cache-based data services.
• Establish security architecture standards and secure-by-design principles across data path, control plane, orchestration, and protocol layers.
• Partner with Data Path engineering teams to secure high-performance data movement across storage tiers, including encryption, integrity verification, secure I/O handling, and low-latency protection mechanisms.
• Drive security architecture reviews, threat modeling, and Secure Software Development Lifecycle (SSDLC) practices across platform engineering initiatives.
• Architect enterprise-grade Identity and Access Management (IAM) frameworks integrating LDAP, Active Directory, OIDC, Keycloak, SSO, MFA, federation, and delegated authorization models.
• Design and govern fine-grained authorization systems leveraging RBAC, ABAC, metadata-aware policy enforcement, and tenant-scoped access controls.
• Define scalable multi-tenant isolation architectures across namespaces, encryption boundaries, policies, quotas, and workload segregation domains while enforcing least privilege principles.
• Collaborate with Control Plane engineering teams to design secure APIs, authentication workflows, policy orchestration, tenant lifecycle management, and platform governance controls.
• Partner with Protocol and Ecosystem teams to secure S3, POSIX/NFS, and related interfaces, including request signing, session security, endpoint hardening, and protocol-level protections.
• Lead platform-wide encryption and key management strategies for data at rest and in transit, including BYOK, tenant-scoped keys, dataset-level encryption policies, KMIP integration, and external KMS interoperability.
• Define observability, telemetry, logging, auditing, and anomaly detection strategies to identify abnormal behavior, insider threats, and potential data exfiltration risks.
• Drive adoption of Zero Trust security principles across distributed systems and infrastructure components.
• Provide technical leadership, mentorship, and architectural guidance across cross-functional engineering teams, influencing secure implementation practices and platform evolution.
• Represent security architecture initiatives in executive, customer, compliance, and strategic partner discussions as needed.

Skills

Security architecture

Distributed systems security

IAM

KMS integration

Zero Trust

RBAC/ABAC

API security

PKI

Security telemetry

Education

Bachelor’s or Master’s in CS/Engineering

Tools

KMIP

SIEM

LDAP/AD

Job description

DDN seeks a Principal Engineer - Security Architecture to define the security strategy for next-generation distributed storage platforms. Lead secure-by-design principles across data path, control plane, and protocol layers while guiding cross-functional teams worldwide.

The role requires deep expertise in cryptography, IAM, multi-tenant isolation, and platform governance, with strong collaboration across data path, protocol, and ecosystem teams.