Senior Software Engineer - Cloud & Platform Security

Atoms; San Francisco (CA); On-site; USD 167,000 - 230,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

Disability insurance

Life insurance

Flexible Spending Account / Health

401(k)

Equity

Sick time and PTO

Team lunch

Job summary

Atoms in San Francisco is seeking a Senior Software Engineer focused on Cloud & Platform Security to partner with our Infrastructure team and secure fleet management systems. You will own security across identities, secrets, and APIs, shaping access controls for production environments.

You will harden Kubernetes controls, implement least-privilege design, and collaborate with engineers to build secure, scalable infrastructure for autonomous vehicle operations.

Qualifications

• 5+ years of experience in cloud, infrastructure, or platform security.
• Hands-on experience working with production Kubernetes environments.
• Strong understanding of API security, including OAuth/OIDC, mTLS, authentication, and authorization design.
• Experience designing or reviewing both coarse-grained and fine-grained authorization models.
• Experience with secrets-management systems such as HashiCorp Vault, cloud KMS, or equivalent technologies.
• Experience managing or securing non-human identities and service-to-service access.
• Strong understanding of network segmentation and access boundaries in cloud environments.
• Demonstrated ability to work closely with infrastructure and software engineering teams and influence security decisions through collaboration.

Responsibilities

• Design and enforce least-privilege access across cloud environments, with a focus on service identities and other non-human access.
• Strengthen secrets and credential management using Vault, cloud KMS, or equivalent systems.
• Threat model and review fleet telemetry, dispatch, and remote-vehicle-control APIs, including authentication, authorization, rate limiting, and replay protection.
• Design and improve network segmentation to isolate fleet-management, dispatch, and remote-control systems from corporate and consumer-facing environments.
• Partner with Infrastructure engineers during architecture and design reviews to identify security requirements before services reach production.
• Review and improve Kubernetes security controls, including RBAC, network policies, and pod security standards, while partnering with the Infrastructure team that owns the platform.

Skills

Cloud security

Kubernetes security

API security

Authorization design

Non-human identities

Network segmentation

Security collaboration

RBAC

Tools

HashiCorp Vault

Cloud KMS

Istio

Kubernetes

Job description

Who we are

Pronto AI is a global leader in commercializing autonomous vehicle (AV) technology, deploying Autonomous Haulage Systems (AHS) that automate operations in mines, quarries, and construction sites worldwide. While much of the industry remains in R&D, we deliver real, production-ready autonomy that is already operating in the field.
We are on a mission to make mining operations safer, smarter, and more efficient through cutting-edge technology, and we are building toward becoming the world’s first profitable AV technology company.

What you’ll do

As a Senior Software Engineer focused on Cloud & Platform Security, you’ll work directly with our Infrastructure team to secure the systems that manage and control our fleet. Rather than duplicating the team’s existing cloud and Kubernetes ownership, you’ll bring deep security expertise across identity, secrets, network segmentation, and the fleet-management and remote-vehicle-control APIs that represent some of the highest-impact systems in our environment.

• Design and enforce least-privilege access across cloud environments, with a focus on service identities and other non-human access.
• Strengthen secrets and credential management using Vault, cloud KMS, or equivalent systems.
• Threat model and review fleet telemetry, dispatch, and remote-vehicle-control APIs, including authentication, authorization, rate limiting, and replay protection.
• Design and improve network segmentation to isolate fleet-management, dispatch, and remote-control systems from corporate and consumer-facing environments.
• Partner with Infrastructure engineers during architecture and design reviews to identify security requirements before services reach production.
• Review and improve Kubernetes security controls, including RBAC, network policies, and pod security standards, while partnering with the Infrastructure team that owns the platform.

What we’re looking for

We’re looking for a hands-on security engineer who can work as an embedded partner to an experienced Infrastructure team. You should be comfortable going deep on cloud and platform security, influencing technical decisions, and helping engineers build secure systems without operating as a gatekeeper..

• 5+ years of experience in cloud, infrastructure, or platform security.
• Hands-on experience working with production Kubernetes environments.
• Strong understanding of API security, including OAuth/OIDC, mTLS, authentication, and authorization design.
• Experience designing or reviewing both coarse-grained and fine-grained authorization models.
• Experience with secrets-management systems such as HashiCorp Vault, cloud KMS, or equivalent technologies.
• Experience managing or securing non-human identities and service-to-service access.
• Strong understanding of network segmentation and access boundaries in cloud environments.
• Demonstrated ability to work closely with infrastructure and software engineering teams and influence security decisions through collaboration.

Nice to have

• Experience securing real-time or low-latency control-plane systems.
• Familiarity with service mesh security and workload-to-workload mTLS using Istio or similar technologies.
• Work on real, production-deployed autonomy.
• Build technology that directly improves safety, efficiency, and productivity.
• Tackle complex challenges in demanding, real-world environments.
• Be part of a fast-moving team with high ownership and impact.
• See your work deployed and making a difference in the field.
• Collaborate closely with experienced engineers and industry operators.

What else you need to know

This role is based in our San Francisco office. Atoms is a company driven by invention and continuous change - we are constantly reimagining our industries, building new products, and refining how we operate. We do our best work together. That’s why all of our office-based teams work onsite, five days a week.

The base salary range for this role is $167,000 - $230,000 per year.

Actual compensation will be determined on an individual basis and may vary depending on experience, skills, and qualifications.

Base salary is just one part of your total rewards package. You may also be eligible for equity awards.

Benefits Summary (USA Full-Time Exempt Employees):

• Medical, Dental, Vision, Disability, and Life Insurance
• Flexible Spending Account / Health Savings Account Options
• 401(k)
• Equity
• Sick Time, Unlimited Flexible Time Off, and Paid Holidays
• Team lunch in our SoMa office every Tuesday and Thursday

Benefits are subject to change at the company's discretion.
Pronto accepts applications on an ongoing basis.

Ready to join us as we serve those who serve others?

#LI-Onsite

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey.Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiringprocess or thereafter. Any information that you do provide will be recorded and maintained in aconfidential file.

As set forth in ATOMS Careers page’s Equal Employment Opportunity policy,we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection.As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measurethe effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categoriesis as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.